upgrade to rails 2.3.16

Fixes important security vulnerability described at http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/

Signed-off-by: Radek Dostal <rd@radekdostal.com>