Backportet fix: Escape the unit value provided to number_to_currencyo

Fixes CVE-2013-6415
Backport: Deep Munge the parameters for GET and POST

Fixes CVE-2013-6417
backport security fix for CVE-2012-1099
backport fix for CVE-2014-0081 (XSS vulnerability in number_to_currency)

Note that number_to_percentage is not affected, number_to_human does not
exist, and only the :format parameter to number_to_currency is not
escaped.

Conflicts:
	Gemfile.lock
	railties/railties.gemspec