patched security hole as recommended by heroku now running rails 3.1.10