Fix some denial of service attacks via hash symbolization.

Ruby does not GC symbols so there is a possible attack where a large
hash could be passed in and symbolized causing memory bloat.

This PR will fix one case involving hashes that are using `strip: true` (the default). Code using `strip: false` is still vulnerable and will need to be corrected in another way.

 - [x] fix vulnerability when using `strip: true`
 - [x] add a note to the hash filter docs noting the security issue when `strip: false` is set

closes #161