Rails session injection challenge