updated Rails version to fix activerecord security flaw