allow length-hiding to be disabled

This will:

- leave length-hiding turned on by default, but allow you to disable it if you want.  Given how the length-hiding interacts with Rack, streaming, etc., this is sometimes desirable.
- pad both html and xhtml responses.
- refer to `ActiveSupport` as `activesupport` rather than `active_support` in the gemspec.
- require `securerandom` in `spec_helper.rb`, so that tests can be run locally.