update to rails 2.2.11 (security fix)
added csrf-headers