fixing attr_protected CVE-2013-0276
stop calling to_sym when building arel nodes [CVE-2013-1854]
Bump to 2.3.18