Avoid Rack security warning no secret provided

This avoids "SECURITY WARNING: No secret option provided to Rack::Session::Cookie."
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping version
Merge remote-tracking branch 'rails/3-1-stable' into 3-1-stable