fix for ActiveRecord 4.0.2 security flaw (http://osvdb.org/show/osvdb/103438)
BUMP