[security] rails 3.2.12 -> 3.2.13

Closes #34, supersedes #36.