worked through http://guides.rubyonrails.org/security.html and closed issue #12