Update rails to fix security issues
this is set in the `set_formats` before filter
check that level is in approved list

Not sure if this will stop the codeclimate warning or not
Use lexical strings everywhere to shut codeclimate up
Merge pull request #327 from theodi/feature-security-fixes

Security fixes highlighted by code climate