Then you should gently persuade them away from JavaServer Faces and Rails too. The same vulnerability exists in both.
JSF was vulnerable to this attack; Thai and Juliano, the researchers that other HN users are trashing on this thread, also found that flaw as well. I have to assume it's been fixed by now.
Section 5.1 of this whitepaper[1] by Rizzo and Duong, that lists Ruby on Rails as one of the web frameworks vulnerable to this attack.
Granted, this paper was published in May, and I'm not a Rails guy, so it's quite possible this has been patched as well.
[1]http://usenix.org/events/woot10/tech/full_papers/Rizzo.pdf