Merge pull request #16095 from eileencodes/update-changelog-for-pr-14899

Add changelog for PR #14899
Merge pull request #13999 from jamox/update_rack

This updates rails to use edge rack
correct markdown usage [ci skip]
Merge pull request #16097 from nishantmodak/correct_md

correct markdown usage [ci skip]
Fix weird comment. [CI SKIP]
[ci skip] Fix 4.2 release notes rendered display.
Merge pull request #16100 from tgxworld/fix_comment

Use proper possessive punctuation [ci skip]
Merge pull request #16102 from JuanitoFatas/format-fixes

[ci skip] Fix 4.2 release notes rendered display.
[ci skip] Fix 4.2 release notes list items. [Matthew Draper & Juanito Fatas]
Merge pull request #16103 from JuanitoFatas/doc/patch-001

[ci skip] Fix 4.2 release notes list items. [Matthew Draper & Juanito Fatas]
Address CVE-2014-4671 (JSONP Flash exploit)

Adds a comment before JSONP callbacks. See
http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for more
details on the exploit in question.
[ci skip] Document millisecond precision change in ActiveSupport::TimeWithZone#as_json
Include missing module in tag_helper

Since 6857415187810f1289068a448268264d0cf0844f we are using #safe_join to
join the content when an Array is given, so we must include the dependent
module here to make sure it's available when this module is used alone.

This was making Simple Form tests to fail with current master due to the
missing dependency.
Merge pull request #16091 from tgxworld/reduce_creation_of_subscribers

Reduce number of subscriptions created.
Merge pull request #16113 from egilburg/rails_4_1_upgrade_guide_json_time_with_zone_precision

[ci skip] Document millisecond precision change in ActiveSupport::TimeWithZone#as_json
[ci skip] Fixed link to strong params in Getting Started section 5.6.
Merge pull request #16118 from JayK31/strong_params_link

[ci skip] Fixed link to strong params in Getting Started section 5.6.
Force encoding of US-ASCII to UTF-8 in unescape_uri.

Because URI paths may contain non US-ASCII characters we need to force
the encoding of any unescaped URIs to UTF-8 if they are US-ASCII.
This essentially replicates the functionality of the monkey patch to
URI.parser.unescape in active_support/core_ext/uri.rb.

Fixes #16104.
Merge pull request #16123 from karlentwistle/issues/9299

Force encoding of US-ASCII to UTF-8 in unescape_uri.
Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash

* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md