[security fix] rails 3.2.12

Closes #34 (replaces #35).