Only accept actions without File::SEPARATOR in the name.

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130
Preparing for 4.0.5 release
Fix tests with bundler 1.6
Merge branch '4-0-sec' into 4-0-stable

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md
	activesupport/CHANGELOG.md
	railties/CHANGELOG.md
Update links to new rails version in guides [ci skip]
Merge pull request #15012 from schneems/schneems/headers-key

HTTP::Headers#key? correctly converts
Merge branch 'rm-trasaction-fix-13166'

Conflicts:
	activerecord/CHANGELOG.md

Backport of #13166
Merge pull request #12746 from coreyward/master

Fix Hash#deep_merge bug and improve documentation — resolves #12738

Conflicts:
	activesupport/lib/active_support/core_ext/hash/deep_merge.rb
	activesupport/test/core_ext/hash_ext_test.rb
Dup the changed_attributes otherwise we could lose them
Fixed HABTM's CollectionAssociation size

HABTM should not include new records as part of #count_records as new records are already counted.

This addresses #14914.