Upgrade to latest rails to address security vulnerability

This is deployed, will merge into master assuming nothing catches fire in the next couple days.