understanding xss in rails