fix some denial of service attacks via hash

Ruby does not GC symbols so there is a possible attack where a large
hash could be passed in and symbolized causing memory bloat. If you are
using `strip: false` the attack is still possible so this is not a
complete solution.
add documentation about a possible security issue
Merge branch 'master' into hash-dos