update Rails due to security vulnerability