pin some gem versions to ensure consistency between local environment and travis, and stop excluding Gemfile.lock