In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964

Fix secure_password setter

`rake notes` and `rake notes:custom` now support css, scss, and css.

Refactor SecurePassword#authenticate

Fix build. It seems that the Mocha's behavior was changed.

Refactor ActionDispatch::HTTP::Url#url_for

Separated right side url generation(before query string)
from left side url generation(after query string)

Distance of time in words should work correctly if from_time > to_time

Upgrading to Mocha 0.11.2 to fix Object#method override

Delete insecure and "bad practice" code. 

Deleting insecure and "bad practice" code. related: http://homakov.blogspot.com/2012/04/whitelist-your-routes-match-is-evil.html

Refactor hash creation in routeset

RouteSet: decomplecting a way to handle positional args

RouteSet: simplify routes helpers generation code

Add missing requires in routes

rake < 0.9 doesn't define Rake::DSL.

Add documentation to the SpawnMethods#merge method.

Refactor GeneratedAttributes

* Move reference? method to class to remove duplicated code
* Move to_sym typecast from #initialize to .parse method (make it
  easier to refactor reference?), remove AS object/blank require
* Use []= instead of merge!({})
* Remove in? in favor of include?, remove AS object/inclusion require

css, scss and css.

Remove circular require warning

This reverts commit 7b7cc134.

Reason: docrails isn't a rails fork. See 5444ed56

[ci skip]

section

Catch nil.to_sym errors in partial_renderer, and raise ArgumentError instead