Lock down Gemfile dependencies

[dsummersl]

We ran into a problem where the pg dependency was upgraded to 1.0.0 (which is incompatible with rails). Lock down the versions we use so that we don't run into this kind of problem again.