initialize post: rails security pitfalls