This merges in the code from the breach-mitigation-rails gem that masks
authenticity tokens on each request by XORing them with a random set of
bytes. The masking is used to make it impossible for an attacker to
steal a CSRF token from an SSL session by using techniques like the
BREACH attack.

The patch is pretty simple - I've copied over the [relevant
code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb)
and updated the tests to pass, mostly by adjusting stubs and mocks.

Perf optimization for `url_for` called w/ Hash

Benchmarking the existing code:

```ruby
{ :only_path => options[:host].nil? }.merge!(options.symbolize_keys)) 
```

Against optimized code, that does not require a new hash or a merge:

```ruby
options = options.symbolize_keys
options[:only_path] = options[:host].nil? unless options.key?(:only_path)
options
```

We see a statistically significant performance gain:

![](https://www.dropbox.com/s/onocpc0zfw4kjxl/Screenshot%202014-08-14%2012.45.30.png?dl=1)

Updated to not mutate incoming parameters

[ci skip] updated 'where' in association documention to new style syntax

Looks like #first wasn't warm enough...

[Regression 4.0 -> 4.1] Fixed AR::Relation#where edge case with Hash and other Relation

Add I18n support for `:placeholder` HTML option is passed to form fields

Example:

  Author.where(posts: { author_id: Author.where(country_id: 1) }).joins(:posts)

Write timestamps only if there are timestamps columns

Conflicts:
	activerecord/CHANGELOG.md

The error was moved outside of the `ClassMethods` module.

Or some tests fail when run in random order

Fixes to ActionController::TemplateAssertions

this will help us to encapsulate magical symbols so hopefully we can
eliminate hardcoded magic symbols

now we don't have to have a hard coded key

avoid hash lookups and remove depency on the instance

we don't need to repeat if statements

now we only have to look up @scope[:scope_level] once per call to
canonical_action? and we don't have a variable named "flag"

since we pass `as` down, then we won't have to do an insert / delete
dance with the options hash

UnexpectedError exceptions wrap the original exception, and the original
exception may contain a reference to something that can't be marshal
dumped which will cause the process to die.

[ci skip] add note about the ERB escape in generator docs

[ci skip] correct default cache store class

The test was not failing for `assert_template file: nil` when a file
has been rendered.