diff --git a/Gemfile b/Gemfile
index 596f2807c17a24d94864e2efdb3effbac1e0551b..3199e0a8f6cb36ac53ae858dbb4fbfffa113a430 100644
--- a/Gemfile
+++ b/Gemfile
@@ -75,6 +75,7 @@ group :test do
 
   # we use cucumber to document and test the api
   gem 'cucumber-rails', require: false
+  gem 'cucumber', '~> 2.4.0'  # version that still supports ruby 2.1
 end
 
 group :test, :development do
@@ -93,7 +94,7 @@ end
 
 group :test, :debug do
   # bundler on jessie doesn't support `:platforms => :ruby_21`
-  gem 'byebug'
+  gem 'byebug', '~> 9.0.6'
 end
 
 ##
diff --git a/Gemfile.lock b/Gemfile.lock
index 2ee1037fa0d36e57db3b1f1e9f6de3a7119a5185..430155be987af929db125ac8724d342ea901de41 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,13 +1,13 @@
 PATH
   remote: engines/billing
   specs:
-    leap_web_billing (0.9.2)
+    leap_web_billing (0.9.3)
       braintree
 
 PATH
   remote: engines/support
   specs:
-    leap_web_help (0.9.2)
+    leap_web_help (0.9.3)
 
 PATH
   remote: vendor/gems/certificate_authority
@@ -26,56 +26,56 @@ GEM
   remote: https://rubygems.org/
   specs:
     SyslogLogger (2.0)
-    actionmailer (4.2.9)
-      actionpack (= 4.2.9)
-      actionview (= 4.2.9)
-      activejob (= 4.2.9)
+    actionmailer (4.2.10)
+      actionpack (= 4.2.10)
+      actionview (= 4.2.10)
+      activejob (= 4.2.10)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.9)
-      actionview (= 4.2.9)
-      activesupport (= 4.2.9)
+    actionpack (4.2.10)
+      actionview (= 4.2.10)
+      activesupport (= 4.2.10)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.9)
-      activesupport (= 4.2.9)
+    actionview (4.2.10)
+      activesupport (= 4.2.10)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.9)
-      activesupport (= 4.2.9)
+    activejob (4.2.10)
+      activesupport (= 4.2.10)
       globalid (>= 0.3.0)
-    activemodel (4.2.9)
-      activesupport (= 4.2.9)
+    activemodel (4.2.10)
+      activesupport (= 4.2.10)
       builder (~> 3.1)
-    activerecord (4.2.9)
-      activemodel (= 4.2.9)
-      activesupport (= 4.2.9)
+    activerecord (4.2.10)
+      activemodel (= 4.2.10)
+      activesupport (= 4.2.10)
       arel (~> 6.0)
-    activesupport (4.2.9)
+    activesupport (4.2.10)
       i18n (~> 0.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    addressable (2.5.1)
-      public_suffix (~> 2.0, >= 2.0.2)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
     arel (6.0.4)
-    autoprefixer-rails (7.1.2.4)
+    autoprefixer-rails (7.2.2)
       execjs
-    binding_of_caller (0.7.2)
+    binding_of_caller (0.7.3)
       debug_inspector (>= 0.0.1)
     bootstrap-sass (3.3.7)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
-    braintree (2.76.0)
+    braintree (2.80.1)
       builder (>= 2.0.0)
     buftok (0.2.0)
     builder (3.2.3)
     byebug (9.0.6)
-    capybara (2.15.1)
+    capybara (2.16.1)
       addressable
       mini_mime (>= 0.1.3)
       nokogiri (>= 1.3.3)
@@ -90,7 +90,7 @@ GEM
       client_side_validations (~> 4.2.12)
       simple_form (~> 3.4)
     cliver (0.3.2)
-    coderay (1.1.1)
+    coderay (1.1.2)
     concurrent-ruby (1.0.5)
     couchrest (2.0.0)
       httpclient (~> 2.8)
@@ -104,6 +104,7 @@ GEM
       actionpack (~> 4.0)
       couchrest (~> 2.0.0.rc3)
       couchrest_model (~> 2.1.0.beta2)
+    crass (1.0.3)
     cucumber (2.4.0)
       builder (>= 2.1.2)
       cucumber-core (~> 1.5.0)
@@ -128,25 +129,23 @@ GEM
     equalizer (0.0.11)
     erubis (2.7.0)
     execjs (2.7.0)
-    factory_girl (4.8.0)
+    factory_girl (4.9.0)
       activesupport (>= 3.0.0)
-    factory_girl_rails (4.8.0)
-      factory_girl (~> 4.8.0)
+    factory_girl_rails (4.9.0)
+      factory_girl (~> 4.9.0)
       railties (>= 3.0.0)
     fake_braintree (0.8.0)
       activesupport
       braintree (~> 2.32)
       capybara (>= 2.2.0)
       sinatra
-    faker (1.8.4)
-      i18n (~> 0.5)
-    faraday (0.11.0)
-      multipart-post (>= 1.2, < 3)
+    faker (1.8.5)
+      i18n (~> 0.9.1)
     ffi (1.9.18)
     gherkin (4.1.3)
-    globalid (0.4.0)
+    globalid (0.4.1)
       activesupport (>= 4.2.0)
-    haml (5.0.2)
+    haml (5.0.4)
       temple (>= 0.8.0)
       tilt
     haml-rails (1.0.0)
@@ -160,18 +159,19 @@ GEM
       haml (>= 4.0, < 6)
       nokogiri (>= 1.6.0)
       ruby_parser (~> 3.5)
-    http (2.2.2)
+    http (3.0.0)
       addressable (~> 2.3)
       http-cookie (~> 1.0)
-      http-form_data (~> 1.0.1)
+      http-form_data (>= 2.0.0.pre.pre2, < 3)
       http_parser.rb (~> 0.6.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
-    http-form_data (1.0.3)
+    http-form_data (2.0.0)
     http_accept_language (2.1.1)
     http_parser.rb (0.6.0)
     httpclient (2.8.3)
-    i18n (0.8.6)
+    i18n (0.9.1)
+      concurrent-ruby (~> 1.0)
     i18n-missing_translations (0.0.1)
     jquery-rails (4.3.1)
       rails-dom-testing (>= 1, < 3)
@@ -179,71 +179,71 @@ GEM
       thor (>= 0.14, < 2.0)
     js_regex (1.2.3)
       regexp_parser (>= 0.3.6, <= 0.5.0)
-    kaminari (1.0.1)
+    kaminari (1.1.1)
       activesupport (>= 4.1.0)
-      kaminari-actionview (= 1.0.1)
-      kaminari-activerecord (= 1.0.1)
-      kaminari-core (= 1.0.1)
-    kaminari-actionview (1.0.1)
+      kaminari-actionview (= 1.1.1)
+      kaminari-activerecord (= 1.1.1)
+      kaminari-core (= 1.1.1)
+    kaminari-actionview (1.1.1)
       actionview
-      kaminari-core (= 1.0.1)
-    kaminari-activerecord (1.0.1)
+      kaminari-core (= 1.1.1)
+    kaminari-activerecord (1.1.1)
       activerecord
-      kaminari-core (= 1.0.1)
-    kaminari-core (1.0.1)
+      kaminari-core (= 1.1.1)
+    kaminari-core (1.1.1)
     launchy (2.4.3)
       addressable (~> 2.3)
     libv8 (3.16.14.19)
-    loofah (2.0.3)
+    loofah (2.1.1)
+      crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    mail (2.6.6)
-      mime-types (>= 1.16, < 4)
+    mail (2.7.0)
+      mini_mime (>= 0.1.1)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
     metaclass (0.0.4)
-    method_source (0.8.2)
+    method_source (0.9.0)
     mime-types (3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2016.0521)
-    mini_mime (0.1.4)
-    mini_portile2 (2.2.0)
+    mini_mime (1.0.0)
+    mini_portile2 (2.3.0)
     minitest (5.10.3)
     minitest-stub-const (0.6)
-    mocha (1.2.1)
+    mocha (1.3.0)
       metaclass (~> 0.0.1)
-    multi_json (1.12.1)
+    multi_json (1.12.2)
     multi_test (0.1.2)
     multipart-post (2.0.0)
     naught (1.1.0)
-    nokogiri (1.8.0)
-      mini_portile2 (~> 2.2.0)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
     phantomjs-binaries (2.1.1.1)
       sys-uname (= 0.9.0)
     poltergeist (1.16.0)
       capybara (~> 2.1)
       cliver (~> 0.3.1)
       websocket-driver (>= 0.2.0)
-    pry (0.10.4)
+    pry (0.11.3)
       coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
+      method_source (~> 0.9.0)
     psych (2.2.4)
-    public_suffix (2.0.5)
+    public_suffix (3.0.1)
     rack (1.6.8)
     rack-protection (1.5.3)
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.9)
-      actionmailer (= 4.2.9)
-      actionpack (= 4.2.9)
-      actionview (= 4.2.9)
-      activejob (= 4.2.9)
-      activemodel (= 4.2.9)
-      activerecord (= 4.2.9)
-      activesupport (= 4.2.9)
+    rails (4.2.10)
+      actionmailer (= 4.2.10)
+      actionpack (= 4.2.10)
+      actionview (= 4.2.10)
+      activejob (= 4.2.10)
+      activemodel (= 4.2.10)
+      activerecord (= 4.2.10)
+      activesupport (= 4.2.10)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.9)
+      railties (= 4.2.10)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -258,30 +258,30 @@ GEM
       railties (~> 4.0)
     rails_warden (0.5.8)
       warden (>= 1.0.0)
-    railties (4.2.9)
-      actionpack (= 4.2.9)
-      activesupport (= 4.2.9)
+    railties (4.2.10)
+      actionpack (= 4.2.10)
+      activesupport (= 4.2.10)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (12.0.0)
+    rake (12.3.0)
     rb-fsevent (0.10.2)
     rb-inotify (0.9.10)
       ffi (>= 0.5.0, < 2)
     rdiscount (2.2.0.1)
     ref (2.0.0)
-    regexp_parser (0.4.4)
+    regexp_parser (0.4.7)
     responders (2.4.0)
       actionpack (>= 4.2.0, < 5.3)
       railties (>= 4.2.0, < 5.3)
     ruby-srp (0.2.1)
     ruby_parser (3.10.1)
       sexp_processor (~> 4.9)
-    sass (3.5.1)
+    sass (3.5.3)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
-    sass-rails (5.0.6)
+    sass-rails (5.0.7)
       railties (>= 4.0.0, < 6)
       sass (~> 3.1)
       sprockets (>= 2.8, < 4.0)
@@ -296,11 +296,10 @@ GEM
       rack (~> 1.5)
       rack-protection (~> 1.4)
       tilt (>= 1.3, < 3)
-    slop (3.6.0)
     sprockets (3.7.1)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.2.0)
+    sprockets-rails (3.2.1)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
@@ -310,34 +309,35 @@ GEM
     therubyracer (0.12.3)
       libv8 (~> 3.16.14.15)
       ref
-    thor (0.19.4)
+    thor (0.20.0)
     thread_safe (0.3.6)
     tilt (2.0.8)
-    twitter (6.1.0)
-      addressable (~> 2.5)
+    twitter (6.2.0)
+      addressable (~> 2.3)
       buftok (~> 0.2.0)
-      equalizer (= 0.0.11)
-      faraday (~> 0.11.0)
-      http (~> 2.1)
+      equalizer (~> 0.0.11)
+      http (~> 3.0)
+      http-form_data (~> 2.0)
       http_parser.rb (~> 0.6.0)
-      memoizable (~> 0.4.2)
-      naught (~> 1.1)
-      simple_oauth (~> 0.3.1)
-    tzinfo (1.2.3)
+      memoizable (~> 0.4.0)
+      multipart-post (~> 2.0)
+      naught (~> 1.0)
+      simple_oauth (~> 0.3.0)
+    tzinfo (1.2.4)
       thread_safe (~> 0.1)
-    uglifier (3.2.0)
+    uglifier (4.0.1)
       execjs (>= 0.3.0, < 3)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.4)
-    valid_email (0.0.13)
+    valid_email (0.1.0)
       activemodel
-      mail (~> 2.6.1)
+      mail (>= 2.6.1)
     warden (1.2.7)
       rack (>= 1.0)
-    websocket-driver (0.6.5)
+    websocket-driver (0.7.0)
       websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.2)
+    websocket-extensions (0.1.3)
     xpath (2.1.0)
       nokogiri (~> 1.3)
 
@@ -348,7 +348,7 @@ DEPENDENCIES
   SyslogLogger (~> 2.0)
   binding_of_caller
   bootstrap-sass
-  byebug
+  byebug (~> 9.0.6)
   capybara
   certificate_authority!
   client_side_validations
@@ -357,6 +357,7 @@ DEPENDENCIES
   couchrest (~> 2.0.0.rc3)
   couchrest_model (~> 2.1.0.beta2)
   couchrest_session_store (~> 0.4.2)
+  cucumber (~> 2.4.0)
   cucumber-rails
   factory_girl_rails
   fake_braintree
@@ -390,4 +391,4 @@ DEPENDENCIES
   valid_email
 
 BUNDLED WITH
-   1.15.3
+   1.16.0