update rails to 3.2.21 (4.0 release)

security release, but only affected when serving assets directly through rails, again

http://weblog.rubyonrails.org/2014/11/17/Rails-3-2-21-4-0-12-and-4-1-8-have-been-released/