Upgrade Rails to patch CVE-2013-0156