update rails, disable default secret_token