#rails 3 code injection