Cherry-picked "changes to address another rails security hole"

Conflicts (which I discarded):
	LatticeGrid.tmproj
	app/controllers/abstracts_controller.rb