1) Because if you forget to add Secure; to the session cookie, it will leak to http:// subdomain in some cases
2) Because http:// subdomain can Cookie Bomb/cookie force main domain or be used for phishing.

That's why *by default* it must include subdomains as it's much more common scenario. Very few websites *intend* to leave their blog.app.com working over http:// while having everything else encrypted. 

Yes, many developers forget to add subdomains=true by default, believe me :)

Only hijack Rack socket when first needed

Fix README heading according to Markdown conventions

Fixes #23471

The first heading in some README's are indicated using a second level
heading (`##`), which in my opinion is of incorrect structure.
Therefore, in this patch I changed the first heading to a first level
heading (`#`) in README's where this incorrect structure occurs.

[ci skip]

Enable ActionCable routes by default

This also marks Action Cable routes as internal to Rails.

Added a test for generating Strong ETag

[ci skip] Need to mention debug_exception_response_format in the api_app documentation.

- #23771 removed the reference to debug_exception_response_format from the api_app documentation.
- We need to let users know, they have ability to configure debug_exception_response_format in their development environment.
- Added documentation for the same in api_app.md file
- Grammar corrections

[ci skip] Replace usage of rake routes with rails routes

I ran into an issue where validations on a suppressed record were
causing validation errors to be thrown on a record that was never going
to be saved.

There isn't a reason to run the validations on a record that doesn't
matter.

This change moves the suppressor up the chain to be run on the `save` or
`save!` in the validations rather than in persistence. The issue with
running it when we hit persistence is that the validations are run
first, then we hit persistance, and then we hit the suppressor. The
suppressor comes first.

The change to the test was required since I added the
`validates_presence_of` validations. Adding this alone was enough to
demonstrate the issue. I added a new test to demonstrate the new
behavior is explict.

* master: (113 commits)
  remove useless method
  Updated file documentation [ci skip]
  changes caching guide to add note on weak etags
  Don't put config.action_mailer.perform_caching entry twice in development.rb
  Fix wording and wrong reference
  Add Ruby formatting to CHANGELOG entry
  Fix ActionView's cache section reference
  Do not define methods in the included block
  Add caching guide in ActionMailer basics
  Add ActionMailer configuration options
  Preparing for 5.0.0.beta3 release
  Update 5.0 release notes
  Enable tmp_restart plugin for puma
  Prep release for Rails 5 beta3
  [ci skip] Move collection caching changelog entry.
  Ensure `drop_table` even if tests failure or interrupted
  💣 run the test @rafaelfranca 😠
  Remove changelog entry for reverted commit
  Add CHANGELOG for https://github.com/rails/rails/pull/23734 [ci skip]
  No need CHANGELOG entry for #23849.
  ...

Updated file documentation [ci skip]

Changes caching guide to add note on weak etags

Don't put config.action_mailer.perform_caching entry twice in development.rb

[ci skip] Update guide sources for mailer view caching feature

Add Ruby formatting to CHANGELOG entry

[ci skip]

Instance methods can be defined in the module itself

Adds changelog headers for beta3 release

Fixes #23855

We changed this in beta2, and only editing the original entry means
people can't see that it was significantly changed.

Ensure `drop_table` even if tests failure or interrupted

I was encountered remaining `:binary_testings` table by tests failure.
When remaining `:binary_testings` table, never reach `drop_table` due to
`create_table` in the test always fails.

I had to revert changes made for this CHANGELOG entry so this is no
longer valid. The change for this entry was removed in 2c02bc0a.