Add Gemfile to be able to execute Rails tests
Update Gemfile to use patched Rails
Add username and password for postgres connection
CVE-2011-0447: Change the CSRF whitelisting to only apply to get requests

Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets.  To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header:

 X-CSRF-Token: ...

This fixes CVE-2011-0447
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
Fixes CVE-2013-0333.  The ActiveSupport::JSON::Backends::Yaml class is present but the functionality has been removed entirely.

Attempted to use cve-2013-0333.patch but did not apply cleanly to v.2.3.5.
Cherry-picked nessissary changes from v2.3.16
Fix for CVE-2013-0155

Attempted to apply patch directly, but would not apply cleanly.
Modified lines as needed, although it looks like given the additional
default arguments added to sanitize_sql_hash_for_conditions, this
case will never be triggered.
CVE-2012-5664 options hashes should only be extracted if there are extra parameters

Patch could not be applied cleanly, but changes manually inserted.
CVE-2011-0446: javascript_escape the email address to prevent apostrophes inadvertently causing javascript errors

Patch didn't apply cleanly to v2.3.5, manually applied
Revert "CVE-2011-0447: Change the CSRF whitelisting to only apply to get requests"

This reverts commit 6752328a029402d1dec99b18ed0693306a44b8ba.

Rails v2.3.5 is not ready for CSRF, so this patch is not needed.
Remove mysql/sqlite gems because we only use Postgres
html_safe not in 2.3.5, use html_safe\!
Add guidence for testing and initial test results