Don't accept params[:to] as HWIA in redirect_to

It is severe client side vulnerability (http://homakov.blogspot.com/2013/11/stealing-user-session-with-open.html). For a while I've been seeing this in many high-profile applications including songkick, airbnb and others.

Whenever you have `redirect_to params[:url]` it is 

1) XSS  using url[status]=200&url[protocol]=javascript&url[f]=%0Aeval(name)

2) way to steal httponly session cookie url[status]=1

Easy to trick user into clicking "redirect" link: http://cobased.com/track?hash=1405177298=http://ok.com/-f45294c86953da8388e2f0f8dff42a14823a4529&url[status]=200&url[protocol]=javascript&url[f]=%0Aeval(name)

This is barely a breaking change because only those who actually pass a hash coming from params will notice the exception. Something like ?params[controller]=&params[action]= is clearly antipattern and we should merge it, IMO. (If something is missing here, maybe you can fix it in your own PR, because i'm not a programmer.)
@senny i'm surprised. Looking into that PR I noticed weird thing: https://github.com/rails/rails/pull/14384/files#diff-3c36e10d8ddf7b11b8a385a283a36d71R154

` when Hash, ActionController::Parameters` - this code was added *exactly* to keep the codebase vulnerable after making params not Hash. Not by purpose, but it's funny

@spastorino thanks for your help!