Avoid Rack security warning no secret provided

This avoids "SECURITY WARNING: No secret option provided to Rack::Session::Cookie."
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping version
Merge branch '3-2-sec' into 3-2-secmerge

* 3-2-sec:
  bumping version
  CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
  * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu
  Avoid Rack security warning no secret provided

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md
	activesupport/CHANGELOG.md
Ignore binds payload with nil column in AR log subscriber

Some tests were raising the following error:

    Could not log "sql.active_record" event. NoMethodError: undefined method
    `type' for nil:NilClass`

Due to the way binds were being logged, the column info was considered
always present, but that is not true for some of the tests listed in the
issue.

Closes #8806.

Conflicts:

	activerecord/lib/active_record/log_subscriber.rb
	activerecord/test/cases/log_subscriber_test.rb

Conflict resolution:
- Revert ruby 1.9 style hash to support ruby 1.8
- Do not include 8f59ffce into 3-2-stable