rails security bug fix