fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
JDOM XXE Protection [CVE-2013-1856]

Conflicts:
	activesupport/test/xml_mini/jdom_engine_test.rb
fix protocol checking in sanitization [CVE-2013-1857]

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb