Rails security fix
Merge remote-tracking branch 'heroku/master'