The Ruby on Rails _json Juggling Attack