Fix a CSRF issue and upgrade to Rails 4.0.2

1. Rails was throwing a 500 error and complaining about a CSRF from Twilio. So I added an exception for twilio#receive.
2. Rails was biting the dust if the list had less than three venues. In practice, it's rare that a list will have less than three venues, but there is a fallback now at least. I also changed some of the wording to reflect this.
3. I also upgraded to Rails 4.0.2. I added a dependency for the `protected_attribute` gem because some of the Rails 3.2 code was incompatible with Rails 4.0.