failure to parse params should trigger a 400 Bad Request
Improve poor security recommendation in docs

As reported in #9960, the current documentation recommends an insecure practice for
key generation from a password (a single round of SHA-256). The modified documentation
uses ActiveSupport::KeyGenerator to perform proper key stretching.
Escape multibyte line terminators in JSON encoding

Currently, json/encoding respects the JSON spec (as it should) which 
disallows \n and \r inside strings, escaping them as expected.

Unfortunately, ECMA-262 (Javascript) disallows not only \n and \r in 
strings, but "Line Terminators" which includes U+2028 and U+2029. 
See here: http://bclary.com/2004/11/07/#a-7.3

This pull request adds U+2028 and U+2029 to be escaped.

# Why? 

It's very common to see something like this in a Rails template:

<script type="text/javascript"> 
var posts = <%= @posts.to_json %>;
</script>

If U+2028 or U+2029 are part of any attributes output in the to_json
call, you will end up with an exception.
In Chrome: Uncaught SyntaxError: Unexpected token ILLEGAL 

# Why not?

This is JSON encoding, and the JSON spec is specific about how to 
encode strings. U+2028 and U+2029 don't get special treatment.

Just trying to start a discussion... what do you do in your apps
to deal with this? Is there a convention I'm missing?
Fixes skipping object callback filters

This allows you to skip callbacks that are defined by objects, e.g. for
`ActionController`:

    skip_after_filter MySpecialFilter

Previously this didn't work due to a bug in how Rails compared callbacks
in `Callback#matches?`. When a callback is compiled, if it's an object
filter (i.e. not a method, proc, etc.), `Callback` now defines a method on
`@klass` that is derived from the class name rather than `@callback_id`.
So, when `skip_callback` tries to find the appropriate callback to
remove, `Callback` can regenerate the method name for the filter
object and return the correct value for `Callback#matches?`.
Fix loading of string arrays in postgres
options_from_collection_for_select helper takes html attributes

as the last element of the array
Changed grammar for better readability
ARel -> Arel
Added description for mtime
Updated link to peepcode Git screencast
Tried to make the response status code table more readable

By making it the last thing in it's section and adding pseudo row headers
Fixed typo [ci skip]
Clarify arguments of head method
Align table of HTTP status codes with set supported by current Rack
Ruby 1.9 hash syntax for action controller guide
more Ruby 1.9 Hash syntax in our guides
Change 'validates_presence_of' to 'presence: true' 

Of course validates_presence_of is still working but it is not explained in the guide, I think consequently should use 'presence: true' in this documentation.
took out unnecessary wordage, changed "number" to "amount"
Fix freeze applying to cloned objects

Previously, freezing a cloned ActiveRecord object froze the original
too. By cloning `@attributes` before freezing, we prevent cloned objects
(which in Ruby share state of ivars) from being effected by `#freeze`.

Resolves issue #4936, which has further information on this issue, as
well as steps to reproduce.

* Add a test case for `#freeze` not causing `cloned.frozen?` to be true.
* Clone @attributes before freezing in `ActiveRecord::Core`, then
  reassign the cloned, frozen hash to the frozen model's `@attributes`
  ivar.

/cc @steveklabnik
Fixed typos in AR CHANGELOG