May be missed in 5fe14163 commit
Also fixes the broken build

The cookie jar can just ask the request object for the information it
needs.  This allows us to stop allocating hashes for options, and also
allows us to delay calculating values in advance.  Generating the
options hash forced us to calculate values that we may never have needed
at runtime

Accessing a request object has nice advantages over accessing a hash.
If you use a missing method name, you'll get an exception rather than a
`nil` (is one nice feature)

spelling fix [ci skip]

example to be consistent [ci skip]

grammatical fix

typo fixes [ci skip]

 - Changed Javascript to JavaScript.
 - Added full-stop which was missing, also wrapped the sentence to 80 chars.
 - Changed proc to Proc and oauth to OAuth.

[ci skip]

specifically are checked for CSRF, when dealing with the browser.

[ci skip]

This approach will avoid us to check for NoMethodError when trying to
decode

Non-string authenticity tokens raised NoMethodError when decoding the
masked token.

[ci skip]

Add nodoc to some constants [skip ci]

This merges in the code from the breach-mitigation-rails gem that masks
authenticity tokens on each request by XORing them with a random set of
bytes. The masking is used to make it impossible for an attacker to
steal a CSRF token from an SSL session by using techniques like the
BREACH attack.

The patch is pretty simple - I've copied over the [relevant
code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb)
and updated the tests to pass, mostly by adjusting stubs and mocks.

[skip ci]

Added the log_warning_on_csrf_failure option to ActionController::RequestForgeryProtection
which is on by default.

Thanks to @homakov for sounding the alarm about JSONP-style data leaking

Previously it was raising a NilException

All ActionPack and Railties tests are passing. Closes #8891.

[Carlos Antonio da Silva + Santiago Pastorino]

See

http://travis-ci.org/#!/rails/rails/jobs/2444632