fixes #5610 - upgrade to Rails 3.2.18
fixes #5612 - use correct permissions for authz in parameters API
fixes #5471 html escape auto-completer values (CVE-2014-0208)