rails + json security upgrade