minor: bumping rails for security fix