In the latest security releases render with a trailing slash no more call
render :file.

Also add a note about the security implications of using it with user
parameters.