Only use valid mime type symbols as cache keys

CVE-2013-6414
Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415

Previously the values were trusted blindly allowing for potential XSS attacks.
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491

Conflicts:
	actionpack/lib/action_view/helpers/translation_helper.rb

Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417

Conflicts:
	actionpack/lib/action_dispatch/http/request.rb
updating the changelog
repair a test broken by the number_to_currency XSS fix
Merge pull request #13162 from makandra/3-2-stable

Repair a test broken by the number_to_currency XSS fix
Fix documentation of number_to_currency helper

Now users have to explicit mark the unit as safe if they trust it.

Closes #13161
Merge pull request #13183 from sorah/never_ignore_i18n_translate_raise_option

Escalate missing error when :raise is true in translate helper, fix regression introduced by security fix.

Conflicts:
	actionpack/CHANGELOG.md
Update Session Store Documentation

session_id doesn't need to be a text column, just string (VARCHAR)
Merge pull request #13315 from tyre/patch-1

Update Session Store Documentation
Fix force_ssl.rb documentation. Close tt tag.

[ci skip]
Merge pull request #13613 from simi/patch-1

Fix force_ssl.rb documentation. Close tt tag.
Escape format, negative_format and units options of number helpers

Previously the values of these options were trusted leading to
potential XSS vulnerabilities.

Fixes: CVE-2014-0081
Use the reference for the mime type to get the format

Before we were calling to_sym in the mime type, even when it is unknown
what can cause denial of service since symbols are not removed by the
garbage collector.

Fixes: CVE-2014-0082
Preparing for 3.2.17 release
Merge branch '3-2-17' into 3-2-stable

Conflicts:
	actionpack/CHANGELOG.md