bugfix: security risk in regexp, replaced ^ with \A and $ w \z, see http://guides.rubyonrails.org/security.html#regular-expressions for explanation