be more specific about csrf token and ajax - not whitelisted outside of jquery-rails [ci skip]
`find_in_batches` now returns an `Enumerator` when called without a block, so that it
can be chained with other `Enumerable` methods.
Fix breakage in XmlMini

- Boolean parsing breaks on non strings (i.e. integer 1|0)
- Symbol parsing breaks on non strings.
- BigDecimal parsing breaks due to missing require.
- Update changelog.
psql implementation of #index_name_exists?
Replace Post with Article in getting started guide [ci skip]

- Used Article model instead of Post as it may confuse with 'post'
  requests
- Tried to wrap the guide to 80 chars lines as much as possible.
- Removed unused image
- Fixes #13764
Add CreateMigration action

This Thor-action isolates the logic whether to (over-)write migration and
what is shown to the user. It's modelled after Thor's CreateFile-action.

This solves the issue that removing a non-existing migration, tried to
remove the template-path (#13588).

Related issues: #12674
Log which keys were set to nil in deep_munge

deep_munge solves CVE-2013-0155 security vulnerability, but its
behaviour is definately confuisng. This commit adds logging to deep_munge.
It logs keys for which values were set to nil.

Also mentions in guides were added.
Handle aliased attributes in AR::Relation#select, #order, etc.

With this we can write `Model#select(:aliased)`, `Model#order(:aliased)`,
`Model#reoder(aliased: :desc)`, etc.

Supplementary work to 54122067acaad39b277a5363c6d11d6804c7bf6b.
Merge pull request #11821 from kuroda/select-and-order-by-aliased-attributes

Handle aliased attributes in AR::Relation#select, #order, etc.
Added documentation for css_compressor
Merge pull request #13813 from lukesarnacki/log-deep-munge

Log for which keys values were set to nil in deep_munge
Merge pull request #13864 from sowjumn/master

Added documentation for css_compressor in asset_pipeline.md
scope is not necessary
always use a block for cleanup / prepare callbacks so we can clean the method signature
Correctly send the string given to lock! and reload(:lock) to the lock scope - fixes #13788

As per the documentation at lock!, if the :lock option is a string it should use the given SQL to generate the lock statement.
Merge pull request #13868 from mauricio/bug-13788

Correctly send the string given to lock! and reload(:lock) to the lock scope - fixes #13788
Allow session serializer key in config.session_store

MessageEncryptor has :serializer option, where any serializer object can
be passed. This commit make it possible to set this serializer from configuration
level.

There are predefined serializers (:marshal_serializer, :json_serialzier)
and custom serializer can be passed as String, Symbol (camelized and
constantized in ActionDispatch::Session namepspace) or serializer object.

Default :json_serializer was also added to generators to provide secure
defalt.
Merge pull request #13692 from lukesarnacki/change-default-session-serializer

Allow session serializer key in config.session_store
Update CHANGELOG properly with GH #13692 [ci-skip]
Fixed a bug in AR::Base#respond_to?

Before:

  >> ActiveRecord::Base.respond_to?(:find_by_something)
  NoMethodError: undefined method `abstract_class?' for Object:Class

After:

  >> ActiveRecord::Base.respond_to?(:find_by_something)
  => false