patch to fix vulnerbility [CVE-2013-1855],[CVE-2013-1857] hope to upgrade to Rails 4 before alpha release