XSS vulnerability in number_to_currency number helper

The unit option passed in `number_to_currency` is not XSS safe. 

**Scenario:**

If the current_user has current_currency and the currency has it's symbol.  If in free text for setting the currency field a Javascript is executed a XSS will happen.

like:

```
 number_to_currency(1.01, unit: "<script>alert('xss') </script>")
```
The XSS prone [example is here](http://hidden-shelf-4318.herokuapp.com) , coming from [this line of code](https://github.com/ankit8898/XSS-prone/blob/master/app/views/users/index.html.erb#L13) of my sample app

This [is the example](http://infinite-taiga-9557.herokuapp.com/users) after the fix from this commit.