Pin active_model_serializers

The "minor" 0.9 release broke a bunch of stuff including an undefined method
error for root_url. Will look into this further...