vulnerable ruby on rails web app