added latest Rails security fixes (18 Feb)