Upgrade rails, security vulnerability