Added a test that shows that a HEAD request does not normally pass CSRF protection
Added request.head? to forgery protection code
Improve String#squish whitespaces matching
Fix cases where delete_records on a has_many association caused errors
because of an ambiguous column name. This happened if the association
model had a default scope that referenced a third table, and the third
table also referenced the original table (with an identical
foreign_key).

Mysql requires that ambiguous columns are deambiguated by using the full
table.column syntax. Postgresql and Sqlite use a different syntax for
updates altogether (and don't tolerate table.name syntax), so the fix
requires always including the full table.column and discarding it later
for Sqlite and Postgresql.
Fix typo: adaptors => adapters [ci skip]
Prevent Relation#merge from collapsing wheres on the RHS

This caused a bug with the new associations implementation, because now
association conditions are represented as Arel nodes internally right up
to when the whole thing gets turned to SQL.

In Rails 3.2, association conditions get turned to raw SQL early on,
which prevents Relation#merge from interfering.

The current implementation was buggy when a default_scope existed on the
target model, since we would basically end up doing:

  default_scope.merge(association_scope)

If default_scope contained a where(foo: 'a') and association_scope
contained a where(foo: 'b').where(foo: 'c') then the merger would see
that the same column is representated on both sides of the merge and
collapse the wheres to all but the last: where(foo: 'c')

Now, the RHS of the merge is left alone.

Fixes #8990
add fetch to CookieJar
Use already defined Encoding constants rather than creating one-trip Strings
Use Encoding::UTF_8 constant :do_not_litter:
Merge pull request #9032 from firmhouse/head-breaks-csrf

Make HEAD work / convert to GET once more
explains why the query cache checks arel.locked
updates a dynamic method heredoc doc
Remove caching_allowed? from ActionController::Caching

Where is this used? No other code references to this method and it
isn't being tested anywhere. No tests fail when commented out.
Make current_url? work with a HEAD method

ActionDispatch::Head was removed in favor of Rack::Head. But Rack::Head
does not convert GET requests to HEAD requests so we need to do
checking for HEAD requests ourselves.
Added a Changelog entry for fixing HEAD requests.
Merge pull request #9098 from firmhouse/add-head-requests

Make current_url? work with HEAD requests and remove caching_allowed? since it doesn't do anything
Merge pull request #8830 from antoinelyset/master

Improve String#squish whitespaces matching
no need for \Z, \z is more concise
Move AS changelog entry to the top, improve AP changelog a bit

[ci skip]
revamps the RDoc of Object#try