Switched to a forked version of rails_xss that includes a fix we need