disable JSON and XML params parsing by default
Use the reference for the mime type to get the format

Before we were calling to_sym in the mime type, even when it is unknown
what can cause denial of service since symbols are not removed by the
garbage collector.

Fixes: CVE-2014-0082
Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415

Previously the values were trusted blindly allowing for potential XSS attacks.
Backport "Deep Munge the parameters for GET and POST"

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417
Backport fix for "Escape format, negative_format and units options of
number helpers"

Previously the values of these options were trusted leading to
potential XSS vulnerabilities.

Fixes: CVE-2014-0081
adapt rails/rails@0f3b7d1a319383f743f9938e1eed00f0fba7a367

Fixes CVE-2014-0130
available_action? not defined in 3-0
Merge pull request #32 from square/so-secure-wow

So secure wow