Address CVE-2014-4671 (JSONP Flash exploit)

Adds a comment before JSONP callbacks. See
http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for more
details on the exploit in question.
Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash

* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
* gcampbell-rosetta_flash:
  Address CVE-2014-4671 (JSONP Flash exploit)
Removed single space padding from empty response body.

`render nothing: true` or rendering a `nil` body no longer add a single
space to the response body.

The old behavior was added as a workaround for a bug in an early version of
Safari, where the HTTP headers are not returned correctly if the response
body has a 0-length. This is been fixed since and the workaround is no
longer necessary.

Use `render body: ' '` if the old behavior is desired.
Merge pull request #14883 from chancancode/rm-single-space

Removed the single space character for Safari
Fixed borken tests in AV caused by 013c74d
Fix incorrect unsubscription.
Synced 4.2 release notes with the latest commits.

Also reordered some of the items to put newer ones on top (same order as
CHANGELOGs), which makes it easier to diff while we are still working on it.
Use `#bytesize` instead of `#size` when checking for cookie overflow

Although the cookie values happens to be ASCII strings because they are
Base64 encoded, it is semantically incorrect to check for the number of the
characters in the cookie, when we actually want to check for the number of the
bytes it consists of.

Furthermore it is unecessary coupling with the current implementation that
uses Base64 for encoding the values.
Merge pull request #16133 from Agis-/cookie_overflow_check

Use `#bytesize` instead of `#size` when checking for cookie overflow
Merge pull request #16132 from tgxworld/fix_test_not_unsubscribing

Fix incorrect unsubscription.
[Postgresql tests] Added enable_extension! to helper