rails security bug fix
Merge branch 'master' of github.com:apatel/privileges