fix critical ruby on rails vulnerability