Apply Rails security patch and remove remaining RuboCop TODOs

And here too, the longer form definitely appears more verbose than the inline form...