config.ru uses the effective Rack app

We used to pass the Rails::Application subclass to #run.
The Rails server then called #to_app to convert that class to the
actual Rack application.

if you surround `#run` with a call to `#map` the server no longer
convertes the class to the instance and we end up with unnecessary
delegation calls on every request.
stop calling to_sym when building arel nodes [CVE-2013-1854]
fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
JDOM XXE Protection [CVE-2013-1856]
fix protocol checking in sanitization [CVE-2013-1857]
Include I18n fallbacks in :locale lookup context
fix repeat of test; remove unused variable by use of each_key
Merge pull request #9763 from vipulnsward/fix_transliterate_test

Fix repeat of test; remove unused variable by use of each_key
Merge pull request #9753 from jbarreneche/bug/render-locale-fallbacks

i18n locale fallback for localized views
`TimeWithZone` raises `NoMethodError` in proper context.

Closes #9772.

`TimeWithZone` delegates everything to the wrapped `Time` object
using `method_missing`. The result is that `NoMethodError` error
will be raised in the context of `Time` which leads to a misleading
debug output.
Merge pull request #9774 from senny/9772_reraise_no_method_error_in_proper_context

`TimeWithZone` raises `NoMethodError` in proper context.
Merge pull request #9669 from senny/rails_method_missing_call

config.ru uses the effective Rack app
Merge branch 'master-sec'

* master-sec:
  fix protocol checking in sanitization [CVE-2013-1857]
  JDOM XXE Protection [CVE-2013-1856]
  fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
  stop calling to_sym when building arel nodes [CVE-2013-1854]
More helpful message when starting server

v2 of pull request based on feedback from @rafaelfranca, @schneems, and @carlosantoniodasilva
Merge pull request #9202 from gkop/more_helpful_message_when_starting_server

More helpful message when starting server
fix typos in AR. lots of them.
Merge pull request #9778 from vipulnsward/fix_typos_in_ar_v1

fix typos in AR. lots of them.
Digest auth should not 500 when given a basic header.
Merge pull request #9022 from braddunbar/digest-basic-auth

Digest auth should not 500 when given a basic header.