Security fix: upgrade to Rails 3.2.12