stop calling to_sym when building arel nodes [CVE-2013-1854]
fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
JDOM XXE Protection [CVE-2013-1856]
fix protocol checking in sanitization [CVE-2013-1857]
Merge branch 'master-sec'

* master-sec:
  fix protocol checking in sanitization [CVE-2013-1857]
  JDOM XXE Protection [CVE-2013-1856]
  fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
  stop calling to_sym when building arel nodes [CVE-2013-1854]