fixed rails vulnerability