rails JSON security patch