https://keita.blog/2013/09/13/rails-security-101/