[CVE-2013-1854] stop calling to_sym when building arel nodes
[CVE-2013-1855] fix incorrect ^$ usage leading to XSS in sanitize_css
[CVE-2013-1856] JDOM XXE Protection

Conflicts:
	activesupport/test/xml_mini/jdom_engine_test.rb
[CVE-2013-1857] fix protocol checking in sanitization

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb