stop calling to_sym when building arel nodes [CVE-2013-1854]
fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
fix protocol checking in sanitization [CVE-2013-1857]

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
	actionpack/test/controller/html-scanner/sanitizer_test.rb
bumping to 2.3.18