backport rails/rails@0f3b7d1a319383f743
Fixes: CVE-2014-0130
Merge pull request #36 from square/nealharris-backport-cve

backport cve-2014-0130 fix