Disable auto-generated form field IDs by passing nil for "id" attribute

Previously it was not possible to opt out of auto-generated ID values
for various form fields.

Freeze ERB string literals

Fix fragment caching in mixed encoding scenario

Ruby 2.1

To reduce ambiguity between char- and byte-based operations, explicitly
do byte operations when extracting the fragment that needs to be cached.

Remove CGI support

Don't reload middleware stack every request

Bump to 2.3.14.github32

CVE-2013-6417

CVE-2013-6415: Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415.

Previously the values were trusted blindly allowing for potential XSS attacks.

This is different from the original upstream patch for 3.x in that return values
from other number helper methods are not marked as html_safe, so the html
escaping always applies. This requires applications to explicitly set .html_safe
on unit strings and number separators when calling number_to_currency.

Load timezone data from one big marshalled file