backport security fix for CVE-2012-1099

Conflicts:
	actionpack/lib/action_view/helpers/form_options_helper.rb
	actionpack/test/abstract_unit.rb