lock Rails to 4.0.x for now