Rails security patches hotfix
Merge remote-tracking branch 'upstream/sfu-deploy' into sfu-deploy