I prepared a fix to this bug in: https://github.com/discourse/discourse/pull/3662
Since this might be a security concern and I am limited in my knowledge of the guardian, I think it is important that some knowledgable people review the change carefully.
EDIT The fix now has been merged.