fix for rails vulnerability