Brakeman fixes

removed sql injection and xss vulnerabilities