[CVE-2013-4491] Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491

Conflicts:
	actionpack/lib/action_view/helpers/translation_helper.rb

Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
[CVE-2013-6414] Only use valid mime type symbols as cache keys

CVE-2013-6414
[CVE-2013-6415] Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415

Previously the values were trusted blindly allowing for potential XSS attacks.
[CVE-2013-6417] Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417

Conflicts:
	actionpack/lib/action_dispatch/http/request.rb