Rails security fixes