lock deps, remove Gemfile.lock