Run thru SecureRails guide

[colinxfleming]

Another guide to go thru before deployment? Wooooo!

Unlike certain other guides this one looks super useful -- https://github.com/ankane/secure_rails

Same deal, go thru the rack and document any action items.

[colinxfleming]

Down the line:

• We should pass thru everything and make sure every use of a secret is within an env var, just to be extra safe (Make sure secrets are all within env vars #411)
• We're injection-safe
• *We aren't using secureheaders, whatever those are -- https://github.com/twitter/secureheaders * (Install secure_headers gem #412)
• We're SSL kosher -- thanks @Kevin-Wei
• We should look into attr_encrypted for hiding sensitive info at rest -- https://github.com/attr-encrypted/attr_encrypted (Use attr_encrypted or symmetric_encryption for protecting sensitive data at rest? #413)
• We should do this host header injection thing -- looks like it's just config edits (Edit config to prevent host header injection #414)
• We should be good on having autocomplete=off for sensitive form fields, thank you @CamLatimer
• We are using devise for auth
• Not sure if we autoemail on email address and password changes but we should, I'll investigate (Autoemail on email address and password changes #415)
• We should limit login attempts -- this guide suggests Rack Attack https://github.com/kickstarter/rack-attack (Rate-limit login form #381)
• We're punting on authorization for now
• We ask search engines not to index anything
• We should consider no-cache on every page (Prevent caching of pages with sensitive information #416)
• We use strong parameters like heroes

[colinxfleming]

Issue-icized; closing!