e.g.

case params[:x]
when ...

should not warn about params[:x]

for ease of subclassing

in particular, don't try to retroactively build call chain.
Fixes #385

Set ActiveSupport.escape_html_entities_in_json=true in versions >= 2.1.0 for autoescaping on a to_json call.

There was a bit of a logic error here, because a
warning might be detected as a duplicate in
`check_for_immediate_xss`, causing it to return 'false'
and then the check would go ahead and process the `raw` call.
This would result in 'weak' confidence warnings that were
duplicates of 'high' confidence warnings.

previously, this would be a weak confidence warning. Change to be the
same as Rails 3 versions which had a vulnerability that caused select
to not escape arguments:
https://groups.google.com/d/topic/rubyonrails-security/CdoMUVpsRmQ/discussion

instead of Sexp#args.first and Sexp#args.second
because Sexp#args creates a new Sexp

same effect, less code

to report the actual piece of code detected as user input for some
warnings