update to rails 3.0.20 to address CVE-2013-0333