add brakeman gem, work on removing SQL interpolation