NoSQL injection - hash injection with rails and mongodb