Upgrade Rails to 4.2.0.beta4. See CVE-2014-7818 and CVE-2014-7819.