Only accept actions without File::SEPARATOR in the name.

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130
Preparing for 4.0.5 release
Fix tests with bundler 1.6
Merge branch '4-0-sec' into 4-0-stable

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md
	activesupport/CHANGELOG.md
	railties/CHANGELOG.md