Bump rails to 4.0.9

* this bump picks up the latest security fixes
* this PR also removes some unused SCSS that was blocking the upgrade