backports CVE-2013-0155

see https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/c7jT-EeN9eI for details

please also consider the accordingly named branch in the test repo