Disable xml and json parsers per security advisory
Only show confirmed pending users
Merge remote-tracking branch 'origin/master'
Rails 3.2.12