update rails for security
fix merge