Make Request#remote_ip return nil when HTTP_X_FORWARDED_FOR is empty

If HTTP_X_FORWARDED_FOR only contains whitespace, don't try to extract a
list of IP addresses from it.
Merge pull request #4202 from dasch/request-remote-ip

Fix bug in `ActionController::Request#remote_ip`
bump up rack version to the one that includes the Hash DoS fix
Merge pull request #4247 from amatsuda/hashdos_23

bump up rack version to the one that includes the Hash DoS fix
Better minimum validates_length_of examples (adapted from master).
Merge pull request #5653 from eee-c/patch-1

Doc fixes in 2.3: validates_length_of
Fix SQL injection via nested hashes in conditions
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
Merge remote-tracking branch 'rails/2-3-stable' into 2-3-stable
Merge pull request #6722 from adgear/2-3-stable

Backported rails 2.3 fix for CVE-2012-2695
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping to 2.3.15 :cry::gun: