bump celluloid version and lock http to safe version