Rails update, security issue