Do not warn about XSS with `to_json` in Rails 4

Rails 4 now safely encodes `to_json` output by default ([change](https://github.com/rails/rails/commit/c13a3f0fc18eec15441e6d88073b92850e93d59a)).