Bump Rails version to fix params vulnerability