changes to address another rails security hole