fix spree sec issue

* http://spreecommerce.com/blog/exploits-found-within-core-and-api
* patch: https://gist.github.com/huoxito/4720074