apply patch for cve-2013-0277

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KtmwSbEpzrU

Didn't apply cleanly to our existing 2-3-github branch but I fixed the remaining conflicts.