Do not mark strip_tags result as html_safe

Thanks to Marek Labos & Nethemba

CVE-2012-3465

Conflicts:

	actionpack/CHANGELOG.md
escape select_tag :prompt values

CVE-2012-3463

Conflicts:

	actionpack/CHANGELOG.md
* Do not convert digest auth strings to symbols. CVE-2012-3424