calling ruby object methods from js securely.