rails 3.0.19 security; blog no comment