Pin the XPath gem, until we can drop Ruby 2.2.0.

Any path versions above 3.1.0 require a newer Ruby than 2.2.0, which we will support in line with Rails requirements.