important security update to rails and json