fix for Rails CVE-2012-5664