use arel rather than slapping together SQL strings