Cherry-picked the XML-parse bug fix

CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.

Discarded the useless conflicts:

	activesupport/CHANGELOG