stop calling to_sym when building arel nodes
fix incorrect ^$ usage leading to XSS in sanitize_css
JDOM XXE Protection

Conflicts:
	activesupport/test/xml_mini/jdom_engine_test.rb
fix protocol checking in sanitization [CVE-2013-1857]

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb