fixing rails vulnerability