upgrade Rails in dummy app
prevent against timing attacks when comparing api keys
handle API key not being passed
bring in secure compare
ignore Gemfile.lock