security fix for Rails 3.2.13