added railsexpress patches for latest CVEs

can you please merge?