Add back set_inverse_instance on .add_to_target

We must have it in there too, so when an existent record is being concat to another,
we will have the inverse relation.
add regression test for set_inverse_instance on add_to_target
Merge pull request #12443 from arthurnn/add_inverse_of_add_target

Add inverse of add target
Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target"

This reverts commit 7ed5bdc834479c39e3b0ad5a38bcffe27983c10d, reversing
changes made to 31c79e291f42b1d862df06c552fe002864aae705.

Reason: this caused a regression when the associated record is creted in
a before_create callback.

See https://github.com/rails/rails/pull/12413#issuecomment-25848163
Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build"

This reverts commit ccd11d58910059f07b28cc518dbdad42cbc8ea0c, reversing
changes made to 54c05acdba138f3a7a3d44dfc922b0fe4e4cf554.

Reason: This caused a regression when the associated record is created
in a before_create callback. See
https://github.com/rails/rails/pull/12413#issuecomment-25848163
Merge branch '3-2-sec' into 3-2-stable

* 3-2-sec:
  updating changelogs
  bumping to 3.2.15
  bumping to rc3
  Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build"
  Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target"
  bumping to rc2
  Merge pull request #12443 from arthurnn/add_inverse_of_add_target
  bumping version to 3.2.15.rc1
  Remove the use of String#% when formatting durations in log messages

Conflicts:
	activerecord/CHANGELOG.md
Only use valid mime type symbols as cache keys

CVE-2013-6414
Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415

Previously the values were trusted blindly allowing for potential XSS attacks.
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491

Conflicts:
	actionpack/lib/action_view/helpers/translation_helper.rb

Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417

Conflicts:
	actionpack/lib/action_dispatch/http/request.rb
updating the changelog
Merge tag 'v3.2.16' of git://github.com/rails/rails into patch-1

v3.2.16