updated rails to close security hole