security patch to address Rails JSON security flaw