Fix issue with attr_protected where malformed input could circumvent protection

Fixes: CVE-2013-0276

Signed-off-by: Scott Fryxell <scott@copper.is>
fix incorrect ^$ usage leading to XSS in sanitize_css

Signed-off-by: Scott Fryxell <scott@copper.is>
stop calling to_sym when building arel nodes

Signed-off-by: Scott Fryxell <scott@copper.is>
fix protocol checking in sanitization [CVE-2013-1857]

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb

Signed-off-by: Scott Fryxell <scott@copper.is>