rack security bug, rspec install