Added Entry model, along with its migration and FactoryGirl factory. Changed Feed model to reflect that entries always belong to a feed.

When fetching and updating feeds, we will save entries in the database. Each time a user goes to a feed, the feed will not be actually fetched, but rather the entries saved in the DB will be shown. Feed updating will happen in the background, using a background job queue (Resque).

This has many advantages:

- Better performance, the app does not have to fetch/parse an XML to show feed entries to the use, it only has to read them from the database.

- In the future the app will store information about read/unread entries for each user.

- Entries have to be fetched only once and are then available for all users suscribed to the feed.
Implemented unit tests for the Entry model.
Feed fields which will be fetched from the XML, and which therefore are not fully trusted, are sanitized before model validations (so, every time a model is saved).

This helps but it's not enough. Better to be paranoid than sorry: sanitize helper will also be called from the presentation layer for each of these fields. This is absolutely necessary; consider for instance this possible value for the url field:

   feed.url = "http://xkcd.com\" onclick=\"javascript:alert('pwned!');"

This value will not be changed at all by the sanitize helper, this is, after this:

   feed.url = sanitize feed.url

the value of feed.url is exactly the same as before; the sanitizer does not catch the javascript injection.

If then we build a link to the feed URL in the view like this:

   <a href="<%=feed.url%>">Feed</a>

we will get a link like this in the page:

   <a href="http://xkcd.com" onclick="javascript:alert('pwned!');">Feed</a>

and we will be thoroughly pwned with a javascript injection.

So, it's absolutely necessary to ALSO sanitize these fields in the views like this:

   <%= sanitize link_to('Feed', feed.url) %>

which catches the attempt at javascript injection and removes it:

   <a href="http://xkcd.com">Feed</a>

Nice!
Sanitize in the view all HTML generated using Feed and Entry fields.
Sanitize all fields in the Entry model before saving in the database.

An exception is the "published" field. It doesn't make much sense to sanitize a field that is stored as a Datetime in the database.
Added field "fetch_url" to Feed model.

The field "url" will be the URL (present in the feed XML) to which the user will be linked when reading the feed. Normally it's the URL of the website that originates the feed.

The field "fetch_url" will be the URL from which the XML of the feed is fetched.
Now Feed model instead of fetching+parsing and returning the feed entries, it saves the entries in the database.
Fixed broken unit tests. Fixed feed index view to account for the latest changes in Feed and Entry models. Added a log message if the application cannot download a feed XML.