What is complicated about it? Someone finally called the Rails team out seriously on a long-standing well known security problem.

This is the type of ridiculous stuff we used to expect from PHP years ago.