security rails and json update