add tests to illustrate symbol leakage problems
update pagination spec
fix batch action symbol leakage
fix url_for symbol leakage

url_for normally symbolizes the keys passed to it. This is a problem
for Active Admin, since we don't want to limit extensibility by
whitelisting which query parameters are persisted on the index page. We
get around this problem by passing the query parameters back into new
URL creation, namespaced under the `:params` key. This way they're
persisted, but arbitrary symbols aren't created in memory.
Merge pull request #1926 from Daxter/security-refactor

Security Fixes