fix for rails CVE-2013-0333