added latest Rails security fixes (4.1.1)