Merge pull request #16118 from JayK31/strong_params_link

[ci skip] Fixed link to strong params in Getting Started section 5.6.
Force encoding of US-ASCII to UTF-8 in unescape_uri.

Because URI paths may contain non US-ASCII characters we need to force
the encoding of any unescaped URIs to UTF-8 if they are US-ASCII.
This essentially replicates the functionality of the monkey patch to
URI.parser.unescape in active_support/core_ext/uri.rb.

Fixes #16104.
Merge pull request #16123 from karlentwistle/issues/9299

Force encoding of US-ASCII to UTF-8 in unescape_uri.
Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash

* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
* gcampbell-rosetta_flash:
  Address CVE-2014-4671 (JSONP Flash exploit)
Merge pull request #11218 from kaspth/loofah-integration

Loofah-integration

Conflicts:
	actionpack/CHANGELOG.md
	actionview/CHANGELOG.md
Dump PostgreSQL primary key with custom function as a default.

For example, if use pgcrypto extension in PostgreSQL 9.4 beta 1, where
uuid-ossp extension isn't available for moment of writing, and thus to
use a gen_random_uuid() method as a primary key default.

In this case schema dumper wasn't able to correctly reconstruct
create_table statement and lost primary key constraint on schema load.

Fixes #16111.
Removed single space padding from empty response body.

`render nothing: true` or rendering a `nil` body no longer add a single
space to the response body.

The old behavior was added as a workaround for a bug in an early version of
Safari, where the HTTP headers are not returned correctly if the response
body has a 0-length. This is been fixed since and the workaround is no
longer necessary.

Use `render body: ' '` if the old behavior is desired.
Merge pull request #14883 from chancancode/rm-single-space

Removed the single space character for Safari
Fixed borken tests in AV caused by 013c74d
Fix incorrect unsubscription.
Synced 4.2 release notes with the latest commits.

Also reordered some of the items to put newer ones on top (same order as
CHANGELOGs), which makes it easier to diff while we are still working on it.
Use `#bytesize` instead of `#size` when checking for cookie overflow

Although the cookie values happens to be ASCII strings because they are
Base64 encoded, it is semantically incorrect to check for the number of the
characters in the cookie, when we actually want to check for the number of the
bytes it consists of.

Furthermore it is unecessary coupling with the current implementation that
uses Base64 for encoding the values.
Merge pull request #16133 from Agis-/cookie_overflow_check

Use `#bytesize` instead of `#size` when checking for cookie overflow
Merge pull request #16132 from tgxworld/fix_test_not_unsubscribing

Fix incorrect unsubscription.
[Guides] Sentence break for clarity [ci-skip]
Merge pull request #16135 from mgoldWork/validator-guide-sentence-break

[Guides] Sentence break for clarity [ci-skip]
Use a type object for type casting behavior on SQLite3
Don't rely on the column SQL type for bit string quoting
AttributeSet#include? -> AttributeSet#key?

https://github.com/rails/rails/pull/15868/files#r14135210