Securing an insecure form in a Rails app.