Merge branch 'hotfix/0.6.9.2'
Upgrade JSON gem to get fix for CVE-2013-0269. Update to latest Rails 2-3 series - has fixes for CVE-2013-0277, CVE-2013-0276, although alaveteli does not use attr_protected or serialize.
Merge remote-tracking branch 'mysociety/hotfix/0.6.9.3' into production