Don't mutate `sanitize` config

Since `Hash#dup` in ruby is shallow and the `sanitize` config is nested, duplicating it
isn't enough to mean that changes to the duplicate are side-effect-free. This change changes the
duplication to a deep-merge.

The deep-merge code is a simplified implementation of the [activesupport version](https://github.com/rails/rails/blob/v4.1.4/activesupport/lib/active_support/core_ext/hash/deep_merge.rb#L21).