security fix for CVE-2014-0130.

trello: https://trello.com/c/0TcN1TSF/602-security-cve-2014-0130.

further reference: https://groups.google.com/forum/\#\!topic/rubyonrails-security/NkKc7vTW70o