Fixed: important security issue with rails 3.2.10