fix rails .js.erb vulnerability [#9]