Set :create_additions to false when parsing json

This is in response to CVE-2013-0269. See
https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58
for details.

Another option is using `multi_json` which takes care of the problem (and allows for usage of any json gem).