Added a test that shows that a HEAD request does not normally pass CSRF protection
Added request.head? to forgery protection code
Improve String#squish whitespaces matching
Fix handling of dirty time zone aware attributes

Previously, when `time_zone_aware_attributes` were enabled, after
changing a datetime or timestamp attribute and then changing it back
to the original value, `changed_attributes` still tracked the
attribute as changed. This caused `[attribute]_changed?` and
`changed?` methods to return true incorrectly.

Example:

    in_time_zone 'Paris' do
      order = Order.new
      original_time = Time.local(2012, 10, 10)
      order.shipped_at = original_time
      order.save
      order.changed? # => false

      # changing value
      order.shipped_at = Time.local(2013, 1, 1)
      order.changed? # => true

      # reverting to original value
      order.shipped_at = original_time
      order.changed? # => false, used to return true
    end
Simplify type casting code for timezone aware attributes

With the addition of String#in_time_zone and Date#in_time_zone
we can simplify the type casting code by checking if the value
has an `in_time_zone` method.
Use `silence` instead of `quietly` to silence the `CheckPending` middleware.

`Kernel.quietly` silences `STDOUT` and `STDERR`, which is useless if
the logger is writing to a file, while `AS::Logger#silence` swaps the
logger level to `ERROR`.

Related to #8820 and #8052.
Merge pull request #9087 from lucasmazza/silence-migration-checks

Use `silence` instead of `quietly` to silence the `CheckPending` middleware.
Fix cases where delete_records on a has_many association caused errors
because of an ambiguous column name. This happened if the association
model had a default scope that referenced a third table, and the third
table also referenced the original table (with an identical
foreign_key).

Mysql requires that ambiguous columns are deambiguated by using the full
table.column syntax. Postgresql and Sqlite use a different syntax for
updates altogether (and don't tolerate table.name syntax), so the fix
requires always including the full table.column and discarding it later
for Sqlite and Postgresql.
Fix typo: adaptors => adapters [ci skip]
Prevent Relation#merge from collapsing wheres on the RHS

This caused a bug with the new associations implementation, because now
association conditions are represented as Arel nodes internally right up
to when the whole thing gets turned to SQL.

In Rails 3.2, association conditions get turned to raw SQL early on,
which prevents Relation#merge from interfering.

The current implementation was buggy when a default_scope existed on the
target model, since we would basically end up doing:

  default_scope.merge(association_scope)

If default_scope contained a where(foo: 'a') and association_scope
contained a where(foo: 'b').where(foo: 'c') then the merger would see
that the same column is representated on both sides of the merge and
collapse the wheres to all but the last: where(foo: 'c')

Now, the RHS of the merge is left alone.

Fixes #8990
add fetch to CookieJar
Use already defined Encoding constants rather than creating one-trip Strings
Use Encoding::UTF_8 constant :do_not_litter:
Merge pull request #9032 from firmhouse/head-breaks-csrf

Make HEAD work / convert to GET once more
explains why the query cache checks arel.locked
updates a dynamic method heredoc doc
Remove caching_allowed? from ActionController::Caching

Where is this used? No other code references to this method and it
isn't being tested anywhere. No tests fail when commented out.
Make current_url? work with a HEAD method

ActionDispatch::Head was removed in favor of Rack::Head. But Rack::Head
does not convert GET requests to HEAD requests so we need to do
checking for HEAD requests ourselves.
Added a Changelog entry for fixing HEAD requests.
Merge pull request #9098 from firmhouse/add-head-requests

Make current_url? work with HEAD requests and remove caching_allowed? since it doesn't do anything