Bump rails to 3.2.18 to address CVE-2014-0130

Should be straight forward, but let me know if anything looks crazy.