added latest Rails security fixes (4.0.2/3.2.16)