Rails 3/4 RCE w/ token
Module polishing, thanks @todb-r7.

Two test-apps (Rails 3/4) are available for this module. Ping me if you want to use them.
Minor typo fix
Adding more blank lines between methods

For readability
Moved classes into the Metasploit3 space

I'm just worried about all those naked classes just hanging around in
the top namespace. This shouldn't impact functionality at all.

While most modules don't define their own classes (this is usually the
job of Msf::Exploit and Rex), I can't think of a reason why you
shouldn't (well, aside from reusability). And yet, very rarely do
modules do it. It's not unknown, though -- the drda.rb capture module
defines a bunch of Constants, and the
post/windows/gather/credentials/bulletproof_ftp.rb module defines some
more interesting things.

So, this should be okay, as long as things are defined in the context of
the Metasploit module proper.
More spacing between ends
Two more fixes, Arch and unneeded include.
Allow user to choose to validate the cookie or not
VALIDATE_COOKIE better grammar on fail message
More explicit title, grammar check on description
Land #2163, known secret session cookie for RoR

From @joernchen, leverages an infoleak to gain a shell on rails
applications. There is no patch, since you are expected to keep your
secrets, well, secret.