Gemfile uses HTTPS, delegates to gemspec, no Gemfile.lock.

See: http://yehudakatz.com/2010/12/16/clarifying-the-roles-of-the-gemspec-and-gemfile/

Prior to this, Bundler 1.3.3 was issuing warnings about the
`source :rubygems` line, and failing to install various old
versions of gems in the Gemfile.lock