Rails security fix