Address CVE-2014-4671 (JSONP Flash exploit)

Adds a comment before JSONP callbacks. See
http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for more
details on the exploit in question.
Force encoding of US-ASCII to UTF-8 in unescape_uri.

Because URI paths may contain non US-ASCII characters we need to force
the encoding of any unescaped URIs to UTF-8 if they are US-ASCII.
This essentially replicates the functionality of the monkey patch to
URI.parser.unescape in active_support/core_ext/uri.rb.

Fixes #16104.
Merge pull request #16123 from karlentwistle/issues/9299

Force encoding of US-ASCII to UTF-8 in unescape_uri.
Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash

* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
* gcampbell-rosetta_flash:
  Address CVE-2014-4671 (JSONP Flash exploit)
Removed single space padding from empty response body.

`render nothing: true` or rendering a `nil` body no longer add a single
space to the response body.

The old behavior was added as a workaround for a bug in an early version of
Safari, where the HTTP headers are not returned correctly if the response
body has a 0-length. This is been fixed since and the workaround is no
longer necessary.

Use `render body: ' '` if the old behavior is desired.
Merge pull request #14883 from chancancode/rm-single-space

Removed the single space character for Safari
Fixed borken tests in AV caused by 013c74d