Merge pull request #9669 from senny/rails_method_missing_call

config.ru uses the effective Rack app
Merge branch 'master-sec'

* master-sec:
  fix protocol checking in sanitization [CVE-2013-1857]
  JDOM XXE Protection [CVE-2013-1856]
  fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
  stop calling to_sym when building arel nodes [CVE-2013-1854]
More helpful message when starting server

v2 of pull request based on feedback from @rafaelfranca, @schneems, and @carlosantoniodasilva
Merge pull request #9202 from gkop/more_helpful_message_when_starting_server

More helpful message when starting server
fix typos in AR. lots of them.
Merge pull request #9778 from vipulnsward/fix_typos_in_ar_v1

fix typos in AR. lots of them.
Digest auth should not 500 when given a basic header.
Merge pull request #9022 from braddunbar/digest-basic-auth

Digest auth should not 500 when given a basic header.
instruct RDoc to only parse Ruby files under lib [Fixes #9779]
1. Change from each to each_value since we did not use key
2. drop assignment of value to sum in test
Use define_method when method name contains weird characters.
Merge pull request #9782 from vipulnsward/change_from_each_to_each_key_habtm

Change from each to each_value;drop assignment in habtm
Revert "instruct RDoc to only parse Ruby files under lib [Fixes #9779]"

This reverts commit c24528fbc94dea9946a563be3bed9559583bdc57.
Fix failing tests related to where values change to strings

Introduced in 5dc2e3531babcbdc165884d1a47cbcd13455522d.
change from blank? to empty? on obvious string values  to save extra method calls
Merge pull request #9784 from vipulnsward/change_from_blank_to_empty_on_string

Change from blank? to empty? on obvious string values  to save extra calls
Revert "Merge pull request #9784 from vipulnsward/change_from_blank_to_empty_on_string"

This reverts commit 9c4c05fc82e997b722dec4068c3aa27eaee69eb8, reversing
changes made to 4620bdcefd0c88905a005f191496df887877b8f3.

Reason: They're not completely interchangeable, since blank? will also
check for strings containing spaces.
"overwritten" is one word
Fix ActiveRecord locking column defaults not getting persisted

When partial inserts are enabled, overridden db defaults are ignored. This
results in locking columns having a nil value for new records if the db default
is null. This happens because the list of changed attributes for new records is
always assumed to be empty.

Solution: When a new record's default attributes are set, also initialize the
list of changed attributes by comparing current values against what's stored as
the column defaults in the database.
Use @app_env_config instead of @env_config

Check pull request #9789 for more information.