Bump Rails to 4.1.5 to pick up security fixes

Other Rails 4.1 apps were doing this, so we should too.