Backport fixes for CVE-2014-0081 from 3.2.x patch

Full info and source patch:
https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4