bumped rails to 3.0.18 to avoid latest CVE

note that bundle update rails is required after this patch