update post: rails security pitfalls