backport patches for CVE-2013-0333

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo
Merge pull request #1 from github/cve-2013-0333

Backport Patches for CVE-2013-0333