Fix sprocket security issue (CVE-2014-7819)

ref:
- https://groups.google.com/forum/#!topic/rubyonrails-security/wQBeGXqGs3E
- https://hakiri.io/issues/cve-2014-7819
Hash#to_h returns self for Hash instances