apply Rails security patch

see https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM

Change-Id: I711f1182195d1847408636ab2f9e77a7f0047ac3
Reviewed-on: https://gerrit.instructure.com/16478
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Stanley Stuart <stanley+gerrit@instructure.com>
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
disable XML params parser

Change-Id: I68b9fd05f6f33f4af5377b1fe9df5e7d3f68db08
Reviewed-on: https://gerrit.instructure.com/16632
Reviewed-by: Zach Wily <zach@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
Tested-by: Brian Palmer <brianp@instructure.com>
apply rails patch for CVE-2013-0155

Change-Id: I730574603071ec4e72c525817282a78fcc4b9d3f
Reviewed-on: https://gerrit.instructure.com/16804
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>