Whitelist `exists` arel method from sqli

per comments in #378 where `exists` is called on the results of `where`.