backport #4f0f1b5 into 3-2-stable. because 1.9.3-p362 warned unused variables.

Conflicts:
	actionpack/test/controller/render_test.rb
Merge pull request #8763 from hsbt/backport-to-hide-warning

Backport 4f0f1b5 into 3-2-stable.

When running the test with warnings enabled, it fails without this change.
Remove suggestion that Procs can be used as session secrets.
(cherry picked from commit 6500d7994e94af439587ba0b6088b14532940ad2)

[ci skip]

Signed-off-by: Andrew White <andyw@pixeltrix.co.uk>
Do not call fields_for from form_for, to avoid instantiating two builders

Conflicts:
	actionpack/lib/action_view/helpers/form_helper.rb
	actionpack/test/template/form_helper_test.rb
Fix error when assigning NaN to an integer column

Also covers any non-castable case by returning nil, which
is in-line with the intention of the former implementation,
but covers the odd cases which respond to to_i but raise
an error when it's called, such as NaN, Infinity and -Infinity.

Fixes #8757

Backport of #8781

Conflicts:
	activerecord/CHANGELOG.md
	activerecord/test/cases/column_test.rb
Remove warnings
Test only with Ruby 1.9+
connection_parameters is an Array and will never have
prepared_statements as value
Fix named scope + class method example

Closes #8804 [ci skip]

Conflicts:
	activerecord/lib/active_record/scoping/named.rb
Remove not used variable in eager test
Refactor write attribute logic to convert number column value

This is an improvement for issue #8673:
    "Comparing a BigDecimal to true/false on write_attribute is slow"

It seems to be an issue with Ruby itself, related to the "coerce" method
being called in TrueClass/FalseClass due to the == condition, triggering
method_missing, then raising a NameError that's later catched.

This issue was also opened in Ruby tracker:
    https://bugs.ruby-lang.org/issues/7645.

This refactoring avoid the coerce call by using a case statement, which
gives us better readability as well. A simple benchmark:

----------

require 'benchmark/ips'
require 'bigdecimal'

Benchmark.ips do |x|
  x.report("== true")   { BigDecimal('3') == true }
  x.report("TrueClass") { TrueClass === BigDecimal('3') }
  x.report("== 0")      { BigDecimal('3') == 0 }
  x.report("Numeric")   { Numeric === BigDecimal('3') }
end

Calculating -------------------------------------
             == true      6427 i/100ms
           TrueClass     47297 i/100ms
                == 0     35923 i/100ms
             Numeric     55530 i/100ms
-------------------------------------------------
             == true    75878.5 (±21.6%) i/s -     359912 in   5.004392s
           TrueClass  1249547.0 (±13.1%) i/s -    6148610 in   5.035964s
                == 0   666856.3 (±13.3%) i/s -    3268993 in   5.013789s
             Numeric  1269300.9 (±11.3%) i/s -    6274890 in   5.028458s

----------

Master has a very different implementation, and there are apparently no
similar conversions at this point, it's mainly delegated to the column
type cast, but I'll check if something needs to be changed there as well.

Closes #8673.
Avoid Rack security warning no secret provided

This avoids "SECURITY WARNING: No secret option provided to Rack::Session::Cookie."
Wrap time ranges with timezones, closes #8807
(cherry picked from commit e2e513621d732abb8efff9120bd9a444836720d6)
(cherry picked from commit dcdde7da481e11660634278a8004175a1ce20f39)

Backport of #6183, original issue was #6179

Conflicts:
	activesupport/lib/active_support/core_ext/time/calculations.rb
	activesupport/test/core_ext/time_ext_test

Signed-off-by: Andrew White <andyw@pixeltrix.co.uk>
Merge pull request #8812 from rubys/master

Eliminate Rack::File headers deprecation warning
Bump rack dependency to 1.4.3

It includes security bug fixes and changes the initialization of
Rack::File to accept a hash, otherwise generating warnings.

See 295806e for the warnings fix.

Conflicts:
	actionpack/actionpack.gemspec
Changelog improvements [ci skip]
Avoid Rack security warning no secret provided

This avoids "SECURITY WARNING: No secret option provided to Rack::Session::Cookie."
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping version