update Rails to 3.2.11
fixes CVE-2013-0156