* Do not convert digest auth strings to symbols. CVE-2012-3424

Conflicts:
	actionpack/lib/action_controller/metal/http_authentication.rb

actionpack/lib/action_controller/metal/http_authentication.rb

@@ -229,9 +229,9 @@ def decode_credentials_header(request)
       end
 
       def decode_credentials(header)
-        Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+        HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
           key, value = pair.split('=', 2)
-          [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').delete('\'')]
+          [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
         end]
       end