Require ActionController::Railtie in the default middleware stack.

This will make possible to do a frameworkless initialization since the
the default middleware stack is self contained.
test for 8018
Be a bit less conservative with mysql in adapter

This will allow the new mysql 2.9.0 to be used, fixing our test issues.
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
Fix issue with attr_protected where malformed input could circumvent
protection

Fixes: CVE-2013-0276
adding test for CVE
stop calling to_sym when building arel nodes [CVE-2013-1854]