Rails security update
Changes to `to_param` it requires a string