Bump Rails to 4.1.6 for the latest security fixes

- Other apps are doing this, so we should too.