adapt rails/rails@0f3b7d1a319383f743f9938e1eed00f0fba7a367

Fixes CVE-2014-0130