Rails 3/4 RCE w/ token