adapt 3.2.x patch for CVE-2014-0081

@square/railsfork-contributors 

See https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4 for context.  This change is adapted from https://15028051456732132684.googlegroups.com/attach/817cbb6b1ed4c28f/3-2-number_helpers_xss.patch?part=3&view=1&vt=ANaJVrF_mkXBVqBZp369--OiCAD7d6Wk7c9sbYJRgM53g9tbdrFxOasvYmWQRdrEJHFXGtPF1Zvot861b-ly8gva9ZuuvtbYSI-YtKzoxoySxF4oNUpa4Mo