if only there were some sort of wiki where all these ad-hoc Rails security guides could be coalesced. hmm, what to do.