fix rails vulnerability