Only accept actions without File::SEPARATOR in the name.

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130

Conflicts:
	actionpack/lib/abstract_controller/base.rb