Remove warning when using html_escape with Ruby 1.9.

Closes #7430
updating changelogs
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
bumping to 3.0.18
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md
	activerecord/lib/active_record/relation/predicate_builder.rb
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping version