adapt rails/rails/commit/0f3b7d1a3 to fix CVE-2014-0130