update rails to be sure we're ok vs latest vuln
fixes S5293 - visible link to done page on board page, and done items popup