Apply Rails security patch and remove remaining RuboCop TODOs

One problem with the original line is that is that `false` doesn’t memoize. That’s why I added the separate return statements.