[#41298561] Fix nested joins

Seems that the vulnerability fix:

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/l4L0TEVAz1k

Has meant that some of our queries across multiple tables has been
broken.  These two files are the first identified and easily fixed.
Others will probably follow from production usage.
Merge pull request #719 from mattdenner/42198561_rails_vulnerabilities

[#41298561] Fix nested joins