rails & json security fixes