Merge pull request #2169 from gwagener/1-0-stable

Bumped Rails version for CVE-2013-0333 and fixed escaping issue caused by new Rails
Manually cherry-picked 31e78c82880b38c31794ac51593849bf8f31890e because the files are too different.