fix form_tag with safe method
Merge branch 'master' into safe-form_tag
safe_buffer everywhere, also in hidden_form_tags