Be a bit less conservative with mysql in adapter

This will allow the new mysql 2.9.0 to be used, fixing our test issues.
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
Fix issue with attr_protected where malformed input could circumvent
protection

Fixes: CVE-2013-0276
adding test for CVE
stop calling to_sym when building arel nodes [CVE-2013-1854]