Merge remote branch 'mainstream/master'

25 files changed, 547 insertions, 514 deletions

diff --git a/actionpack/lib/action_controller/metal/benchmarking.rb b/actionpack/lib/action_controller/metal/benchmarking.rb
deleted file mode 100644
index e58df69172..0000000000
--- a/actionpack/lib/action_controller/metal/benchmarking.rb
+++ /dev/null
@@ -1,73 +0,0 @@
-require 'active_support/core_ext/benchmark'
-
-module ActionController #:nodoc:
-  # The benchmarking module times the performance of actions and reports to the logger. If the Active Record
-  # package has been included, a separate timing section for database calls will be added as well.
-  module Benchmarking #:nodoc:
-    extend ActiveSupport::Concern
-
-    protected
-      def render(*args, &block)
-        if logger
-          if Object.const_defined?("ActiveRecord") && ActiveRecord::Base.connected?
-            db_runtime = ActiveRecord::Base.connection.reset_runtime
-          end
-
-          render_output = nil
-          @view_runtime = Benchmark.ms { render_output = super }
-
-          if Object.const_defined?("ActiveRecord") && ActiveRecord::Base.connected?
-            @db_rt_before_render = db_runtime
-            @db_rt_after_render = ActiveRecord::Base.connection.reset_runtime
-            @view_runtime -= @db_rt_after_render
-          end
-
-          render_output
-        else
-          super
-        end
-      end
-
-    private
-      def process_action(*args)
-        if logger
-          ms = [Benchmark.ms { super }, 0.01].max
-          logging_view          = defined?(@view_runtime)
-          logging_active_record = Object.const_defined?("ActiveRecord") && ActiveRecord::Base.connected?
-
-          log_message  = 'Completed in %.0fms' % ms
-
-          if logging_view || logging_active_record
-            log_message << " ("
-            log_message << view_runtime if logging_view
-
-            if logging_active_record
-              log_message << ", " if logging_view
-              log_message << active_record_runtime + ")"
-            else
-              ")"
-            end
-          end
-
-          log_message << " | #{response.status}"
-          log_message << " [#{complete_request_uri rescue "unknown"}]"
-
-          logger.info(log_message)
-          response.headers["X-Runtime"] = "%.0f" % ms
-        else
-          super
-        end
-      end
-
-      def view_runtime
-        "View: %.0f" % @view_runtime
-      end
-
-      def active_record_runtime
-        db_runtime = ActiveRecord::Base.connection.reset_runtime
-        db_runtime += @db_rt_before_render if @db_rt_before_render
-        db_runtime += @db_rt_after_render if @db_rt_after_render
-        "DB: %.0f" % db_runtime
-      end
-  end
-end
diff --git a/actionpack/lib/action_controller/metal/compatibility.rb b/actionpack/lib/action_controller/metal/compatibility.rb
index c251d79f4e..a90f798cd5 100644
--- a/actionpack/lib/action_controller/metal/compatibility.rb
+++ b/actionpack/lib/action_controller/metal/compatibility.rb
@@ -1,5 +1,5 @@
 module ActionController
-  module Rails2Compatibility
+  module Compatibility
     extend ActiveSupport::Concern
 
     class ::ActionController::ActionControllerError < StandardError #:nodoc:
@@ -46,11 +46,8 @@ module ActionController
       cattr_accessor :use_accept_header
       self.use_accept_header = true
 
-      cattr_accessor :page_cache_directory
       self.page_cache_directory = defined?(Rails.public_path) ? Rails.public_path : ""
 
-      cattr_reader :cache_store
-
       cattr_accessor :consider_all_requests_local
       self.consider_all_requests_local = true
 
@@ -116,7 +113,7 @@ module ActionController
       details[:prefix] = nil if name =~ /\blayouts/
       super
     end
-    
+
     # Move this into a "don't run in production" module
     def _default_layout(details, require_layout = false)
       super
diff --git a/actionpack/lib/action_controller/metal/conditional_get.rb b/actionpack/lib/action_controller/metal/conditional_get.rb
index 5156fbc1d5..61e7ece90d 100644
--- a/actionpack/lib/action_controller/metal/conditional_get.rb
+++ b/actionpack/lib/action_controller/metal/conditional_get.rb
@@ -2,7 +2,7 @@ module ActionController
   module ConditionalGet
     extend ActiveSupport::Concern
 
-    include RackConvenience
+    include RackDelegation
     include Head
 
     # Sets the etag, last_modified, or both on the response and renders a
diff --git a/actionpack/lib/action_controller/metal/cookies.rb b/actionpack/lib/action_controller/metal/cookies.rb
index 6855ca1478..5b51bd21d0 100644
--- a/actionpack/lib/action_controller/metal/cookies.rb
+++ b/actionpack/lib/action_controller/metal/cookies.rb
@@ -46,17 +46,18 @@ module ActionController #:nodoc:
   module Cookies
     extend ActiveSupport::Concern
 
-    include RackConvenience
+    include RackDelegation
 
     included do
       helper_method :cookies
+      cattr_accessor :cookie_verifier_secret
     end
 
-  protected
-    # Returns the cookie container, which operates as described above.
-    def cookies
-      @cookies ||= CookieJar.build(request, response)
-    end
+    protected
+      # Returns the cookie container, which operates as described above.
+      def cookies
+        @cookies ||= CookieJar.build(request, response)
+      end
   end
 
   class CookieJar < Hash #:nodoc:
@@ -86,7 +87,7 @@ module ActionController #:nodoc:
       end
 
       super(key.to_s, value)
-      
+
       options[:path] ||= "/"
       response.set_cookie(key, options)
     end
@@ -101,5 +102,96 @@ module ActionController #:nodoc:
       response.delete_cookie(key, options)
       value
     end
+
+    # Returns a jar that'll automatically set the assigned cookies to have an expiration date 20 years from now. Example:
+    #
+    #   cookies.permanent[:prefers_open_id] = true
+    #   # => Set-Cookie: prefers_open_id=true; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
+    #
+    # This jar is only meant for writing. You'll read permanent cookies through the regular accessor.
+    #
+    # This jar allows chaining with the signed jar as well, so you can set permanent, signed cookies. Examples:
+    #
+    #   cookies.permanent.signed[:remember_me] = current_user.id
+    #   # => Set-Cookie: discount=BAhU--848956038e692d7046deab32b7131856ab20e14e; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
+    def permanent
+      @permanent ||= PermanentCookieJar.new(self)
+    end
+
+    # Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from
+    # the cookie again. This is useful for creating cookies with values that the user is not supposed to change. If a signed
+    # cookie was tampered with by the user (or a 3rd party), an ActiveSupport::MessageVerifier::InvalidSignature exception will
+    # be raised.
+    #
+    # This jar requires that you set a suitable secret for the verification on ActionController::Base.cookie_verifier_secret.
+    #
+    # Example:
+    #
+    #   cookies.signed[:discount] = 45
+    #   # => Set-Cookie: discount=BAhpMg==--2c1c6906c90a3bc4fd54a51ffb41dffa4bf6b5f7; path=/
+    #
+    #   cookies.signed[:discount] # => 45
+    def signed
+      @signed ||= SignedCookieJar.new(self)
+    end
+  end
+
+  class PermanentCookieJar < CookieJar #:nodoc:
+    def initialize(parent_jar)
+      @parent_jar = parent_jar
+    end
+
+    def []=(key, options)
+      if options.is_a?(Hash)
+        options.symbolize_keys!
+      else
+        options = { :value => options }
+      end
+
+      options[:expires] = 20.years.from_now
+      @parent_jar[key] = options
+    end
+
+    def signed
+      @signed ||= SignedCookieJar.new(self)
+    end
+
+    def controller
+      @parent_jar.controller
+    end
+
+    def method_missing(method, *arguments, &block)
+      @parent_jar.send(method, *arguments, &block)
+    end
+  end
+
+  class SignedCookieJar < CookieJar #:nodoc:
+    def initialize(parent_jar)
+      unless ActionController::Base.cookie_verifier_secret
+        raise "You must set ActionController::Base.cookie_verifier_secret to use signed cookies"
+      end
+
+      @parent_jar = parent_jar
+      @verifier = ActiveSupport::MessageVerifier.new(ActionController::Base.cookie_verifier_secret)
+    end
+
+    def [](name)
+      @verifier.verify(@parent_jar[name])
+    end
+
+    def []=(key, options)
+      if options.is_a?(Hash)
+        options.symbolize_keys!
+        options[:value] = @verifier.generate(options[:value])
+      else
+        options = { :value => @verifier.generate(options) }
+      end
+
+      @parent_jar[key] = options
+    end
+
+    def method_missing(method, *arguments, &block)
+      @parent_jar.send(method, *arguments, &block)
+    end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/exceptions.rb b/actionpack/lib/action_controller/metal/exceptions.rb
index b9d23da3e0..07024d0a9a 100644
--- a/actionpack/lib/action_controller/metal/exceptions.rb
+++ b/actionpack/lib/action_controller/metal/exceptions.rb
@@ -18,18 +18,9 @@ module ActionController
 
     def initialize(*allowed_methods)
       super("Only #{allowed_methods.to_sentence(:locale => :en)} requests are allowed.")
-      @allowed_methods = allowed_methods
-    end
-
-    def allowed_methods_header
-      allowed_methods.map { |method_symbol| method_symbol.to_s.upcase } * ', '
-    end
-
-    def handle_response!(response)
-      response.headers['Allow'] ||= allowed_methods_header
     end
   end
-  
+
   class NotImplemented < MethodNotAllowed #:nodoc:
   end
 
diff --git a/actionpack/lib/action_controller/metal/filter_parameter_logging.rb b/actionpack/lib/action_controller/metal/filter_parameter_logging.rb
index a53c052075..59e200396a 100644
--- a/actionpack/lib/action_controller/metal/filter_parameter_logging.rb
+++ b/actionpack/lib/action_controller/metal/filter_parameter_logging.rb
@@ -2,8 +2,6 @@ module ActionController
   module FilterParameterLogging
     extend ActiveSupport::Concern
 
-    include AbstractController::Logger
-
     module ClassMethods
       # Replace sensitive parameter data from the request log.
       # Filters parameters that have any of the arguments as a substring.
@@ -54,23 +52,25 @@ module ActionController
         end
         protected :filter_parameters
       end
-    end
 
-    INTERNAL_PARAMS = [:controller, :action, :format, :_method, :only_path]
+    protected
 
-    def process(*)
-      response = super
-      if logger
-        parameters = filter_parameters(params).except!(*INTERNAL_PARAMS)
-        logger.info { "  Parameters: #{parameters.inspect}" } unless parameters.empty?
+      # Overwrite log_process_action to include parameters information.
+      # If this method is invoked, it means logger is defined, so don't
+      # worry with such scenario here.
+      def log_process_action(controller) #:nodoc:
+        params = controller.send(:filter_parameters, controller.request.params)
+        logger.info "  Parameters: #{params.inspect}" unless params.empty?
+        super
       end
-      response
     end
 
+    INTERNAL_PARAMS = [:controller, :action, :format, :_method, :only_path]
+
   protected
 
     def filter_parameters(params)
-      params.dup
+      params.dup.except!(*INTERNAL_PARAMS)
     end
 
   end
diff --git a/actionpack/lib/action_controller/metal/flash.rb b/actionpack/lib/action_controller/metal/flash.rb
index feb066a6f6..25e25940a7 100644
--- a/actionpack/lib/action_controller/metal/flash.rb
+++ b/actionpack/lib/action_controller/metal/flash.rb
@@ -28,7 +28,9 @@ module ActionController #:nodoc:
   module Flash
     extend ActiveSupport::Concern
 
-    include Session
+    included do
+      helper_method :alert, :notice
+    end
 
     class FlashNow #:nodoc:
       def initialize(flash)
@@ -121,30 +123,18 @@ module ActionController #:nodoc:
         session["flash"] = self
       end
 
-    private
-      # Used internally by the <tt>keep</tt> and <tt>discard</tt> methods
-      #     use()               # marks the entire flash as used
-      #     use('msg')          # marks the "msg" entry as used
-      #     use(nil, false)     # marks the entire flash as unused (keeps it around for one more action)
-      #     use('msg', false)   # marks the "msg" entry as unused (keeps it around for one more action)
-      # Returns the single value for the key you asked to be marked (un)used or the FlashHash itself
-      # if no key is passed.
-      def use(key = nil, used = true)
-        Array(key || keys).each { |k| used ? @used << k : @used.delete(k) }
-        return key ? self[key] : self
-      end
-    end
-
-  protected
-    def process_action(method_name)
-      super
-      @_flash.store(session) if @_flash
-      @_flash = nil
-    end
-
-    def reset_session
-      super
-      @_flash = nil
+      private
+        # Used internally by the <tt>keep</tt> and <tt>discard</tt> methods
+        #     use()               # marks the entire flash as used
+        #     use('msg')          # marks the "msg" entry as used
+        #     use(nil, false)     # marks the entire flash as unused (keeps it around for one more action)
+        #     use('msg', false)   # marks the "msg" entry as unused (keeps it around for one more action)
+        # Returns the single value for the key you asked to be marked (un)used or the FlashHash itself
+        # if no key is passed.
+        def use(key = nil, used = true)
+          Array(key || keys).each { |k| used ? @used << k : @used.delete(k) }
+          return key ? self[key] : self
+        end
     end
 
     # Access the contents of the flash. Use <tt>flash["notice"]</tt> to
@@ -158,5 +148,54 @@ module ActionController #:nodoc:
 
       @_flash
     end
+
+    # Convenience accessor for flash[:alert]
+    def alert
+      flash[:alert]
+    end
+
+    # Convenience accessor for flash[:alert]=
+    def alert=(message)
+      flash[:alert] = message
+    end
+
+    # Convenience accessor for flash[:notice]
+    def notice
+      flash[:notice]
+    end
+
+    # Convenience accessor for flash[:notice]=
+    def notice=(message)
+      flash[:notice] = message
+    end
+
+    protected
+      def process_action(method_name)
+        @_flash = nil
+        super
+        @_flash.store(session) if @_flash
+        @_flash = nil
+      end
+
+      def reset_session
+        super
+        @_flash = nil
+      end
+
+      def redirect_to(options = {}, response_status_and_flash = {}) #:doc:
+        if alert = response_status_and_flash.delete(:alert)
+          flash[:alert] = alert
+        end
+
+        if notice = response_status_and_flash.delete(:notice)
+          flash[:notice] = notice
+        end
+
+        if other_flashes = response_status_and_flash.delete(:flash)
+          flash.update(other_flashes)
+        end
+
+        super(options, response_status_and_flash)
+      end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/head.rb b/actionpack/lib/action_controller/metal/head.rb
index 68fa0a0402..c82d9cf369 100644
--- a/actionpack/lib/action_controller/metal/head.rb
+++ b/actionpack/lib/action_controller/metal/head.rb
@@ -1,5 +1,7 @@
 module ActionController
   module Head
+    include UrlFor
+
     # Return a response that has no content (merely headers). The options
     # argument is interpreted to be a hash of header names and values.
     # This allows you to easily return a response that consists only of
@@ -21,7 +23,10 @@ module ActionController
         headers[key.to_s.dasherize.split(/-/).map { |v| v.capitalize }.join("-")] = value.to_s
       end
 
-      render :nothing => true, :status => status, :location => location
+      self.status = status
+      self.location = url_for(location) if location
+      self.content_type = Mime[formats.first]
+      self.response_body = " "
     end
   end
 end
\ No newline at end of file
diff --git a/actionpack/lib/action_controller/metal/helpers.rb b/actionpack/lib/action_controller/metal/helpers.rb
index b4325e24ad..d0402e5bad 100644
--- a/actionpack/lib/action_controller/metal/helpers.rb
+++ b/actionpack/lib/action_controller/metal/helpers.rb
@@ -52,7 +52,7 @@ module ActionController
     included do
       # Set the default directory for helpers
       extlib_inheritable_accessor(:helpers_dir) do
-        defined?(Rails) ? "#{Rails.root}/app/helpers" : "app/helpers"
+        defined?(Rails.root) ? "#{Rails.root}/app/helpers" : "app/helpers"
       end
     end
 
diff --git a/actionpack/lib/action_controller/metal/layouts.rb b/actionpack/lib/action_controller/metal/layouts.rb
deleted file mode 100644
index cc7088248a..0000000000
--- a/actionpack/lib/action_controller/metal/layouts.rb
+++ /dev/null
@@ -1,171 +0,0 @@
-module ActionController
-  # Layouts reverse the common pattern of including shared headers and footers in many templates to isolate changes in
-  # repeated setups. The inclusion pattern has pages that look like this:
-  #
-  #   <%= render "shared/header" %>
-  #   Hello World
-  #   <%= render "shared/footer" %>
-  #
-  # This approach is a decent way of keeping common structures isolated from the changing content, but it's verbose
-  # and if you ever want to change the structure of these two includes, you'll have to change all the templates.
-  #
-  # With layouts, you can flip it around and have the common structure know where to insert changing content. This means
-  # that the header and footer are only mentioned in one place, like this:
-  #
-  #   // The header part of this layout
-  #   <%= yield %>
-  #   // The footer part of this layout
-  #
-  # And then you have content pages that look like this:
-  #
-  #    hello world
-  #
-  # At rendering time, the content page is computed and then inserted in the layout, like this:
-  #
-  #   // The header part of this layout
-  #   hello world
-  #   // The footer part of this layout
-  #
-  # == Accessing shared variables
-  #
-  # Layouts have access to variables specified in the content pages and vice versa. This allows you to have layouts with
-  # references that won't materialize before rendering time:
-  #
-  #   <h1><%= @page_title %></h1>
-  #   <%= yield %>
-  #
-  # ...and content pages that fulfill these references _at_ rendering time:
-  #
-  #    <% @page_title = "Welcome" %>
-  #    Off-world colonies offers you a chance to start a new life
-  #
-  # The result after rendering is:
-  #
-  #   <h1>Welcome</h1>
-  #   Off-world colonies offers you a chance to start a new life
-  #
-  # == Layout assignment
-  #
-  # You can either specify a layout declaratively (using the #layout class method) or give
-  # it the same name as your controller, and place it in <tt>app/views/layouts</tt>.
-  # If a subclass does not have a layout specified, it inherits its layout using normal Ruby inheritance.
-  #
-  # For instance, if you have PostsController and a template named <tt>app/views/layouts/posts.html.erb</tt>,
-  # that template will be used for all actions in PostsController and controllers inheriting
-  # from PostsController.
-  #
-  # If you use a module, for instance Weblog::PostsController, you will need a template named
-  # <tt>app/views/layouts/weblog/posts.html.erb</tt>.
-  #
-  # Since all your controllers inherit from ApplicationController, they will use
-  # <tt>app/views/layouts/application.html.erb</tt> if no other layout is specified
-  # or provided.
-  #
-  # == Inheritance Examples
-  #
-  #   class BankController < ActionController::Base
-  #     layout "bank_standard"
-  #
-  #   class InformationController < BankController
-  #
-  #   class TellerController < BankController
-  #     # teller.html.erb exists
-  #
-  #   class TillController < TellerController
-  #
-  #   class VaultController < BankController
-  #     layout :access_level_layout
-  #
-  #   class EmployeeController < BankController
-  #     layout nil
-  #
-  # The InformationController uses "bank_standard" inherited from the BankController, the VaultController overwrites
-  # and picks the layout dynamically, and the EmployeeController doesn't want to use a layout at all.
-  #
-  # The TellerController uses +teller.html.erb+, and TillController inherits that layout and
-  # uses it as well.
-  #
-  # == Types of layouts
-  #
-  # Layouts are basically just regular templates, but the name of this template needs not be specified statically. Sometimes
-  # you want to alternate layouts depending on runtime information, such as whether someone is logged in or not. This can
-  # be done either by specifying a method reference as a symbol or using an inline method (as a proc).
-  #
-  # The method reference is the preferred approach to variable layouts and is used like this:
-  #
-  #   class WeblogController < ActionController::Base
-  #     layout :writers_and_readers
-  #
-  #     def index
-  #       # fetching posts
-  #     end
-  #
-  #     private
-  #       def writers_and_readers
-  #         logged_in? ? "writer_layout" : "reader_layout"
-  #       end
-  #
-  # Now when a new request for the index action is processed, the layout will vary depending on whether the person accessing
-  # is logged in or not.
-  #
-  # If you want to use an inline method, such as a proc, do something like this:
-  #
-  #   class WeblogController < ActionController::Base
-  #     layout proc{ |controller| controller.logged_in? ? "writer_layout" : "reader_layout" }
-  #
-  # Of course, the most common way of specifying a layout is still just as a plain template name:
-  #
-  #   class WeblogController < ActionController::Base
-  #     layout "weblog_standard"
-  #
-  # If no directory is specified for the template name, the template will by default be looked for in <tt>app/views/layouts/</tt>.
-  # Otherwise, it will be looked up relative to the template root.
-  #
-  # == Conditional layouts
-  #
-  # If you have a layout that by default is applied to all the actions of a controller, you still have the option of rendering
-  # a given action or set of actions without a layout, or restricting a layout to only a single action or a set of actions. The
-  # <tt>:only</tt> and <tt>:except</tt> options can be passed to the layout call. For example:
-  #
-  #   class WeblogController < ActionController::Base
-  #     layout "weblog_standard", :except => :rss
-  #
-  #     # ...
-  #
-  #   end
-  #
-  # This will assign "weblog_standard" as the WeblogController's layout  except for the +rss+ action, which will not wrap a layout
-  # around the rendered view.
-  #
-  # Both the <tt>:only</tt> and <tt>:except</tt> condition can accept an arbitrary number of method references, so
-  # #<tt>:except => [ :rss, :text_only ]</tt> is valid, as is <tt>:except => :rss</tt>.
-  #
-  # == Using a different layout in the action render call
-  #
-  # If most of your actions use the same layout, it makes perfect sense to define a controller-wide layout as described above.
-  # Sometimes you'll have exceptions where one action wants to use a different layout than the rest of the controller.
-  # You can do this by passing a <tt>:layout</tt> option to the <tt>render</tt> call. For example:
-  #
-  #   class WeblogController < ActionController::Base
-  #     layout "weblog_standard"
-  #
-  #     def help
-  #       render :action => "help", :layout => "help"
-  #     end
-  #   end
-  #
-  # This will render the help action with the "help" layout instead of the controller-wide "weblog_standard" layout.
-  module Layouts
-    extend ActiveSupport::Concern
-
-    include ActionController::RenderingController
-    include AbstractController::Layouts
-
-    module ClassMethods
-      # If no layout is provided, look for a layout with this name.
-      def _implied_layout_name
-        controller_path
-      end
-    end
-  end
-end
diff --git a/actionpack/lib/action_controller/metal/logger.rb b/actionpack/lib/action_controller/metal/logger.rb
new file mode 100644
index 0000000000..4f4370e5f0
--- /dev/null
+++ b/actionpack/lib/action_controller/metal/logger.rb
@@ -0,0 +1,89 @@
+require 'abstract_controller/logger'
+
+module ActionController
+  # Adds instrumentation to <tt>process_action</tt> and a <tt>log_event</tt> method
+  # responsible to log events from ActiveSupport::Notifications. This module handles
+  # :process_action and :render_template events but allows any other module to hook
+  # into log_event and provide its own logging facilities (as in ActionController::Caching).
+  module Logger
+    extend ActiveSupport::Concern
+
+    included do
+      include AbstractController::Logger
+    end
+
+    attr_internal :view_runtime
+
+    def process_action(action)
+      ActiveSupport::Notifications.instrument(:process_action, :controller => self, :action => action) do
+        super
+      end
+    end
+
+    def render(*args, &block)
+      if logger
+        render_output = nil
+
+        self.view_runtime = cleanup_view_runtime do
+          Benchmark.ms { render_output = super }
+        end
+
+        render_output
+      else
+        super
+      end
+    end
+
+    # If you want to remove any time taken into account in :view_runtime
+    # wrongly, you can do it here:
+    #
+    #   def cleanup_view_runtime
+    #     super - time_taken_in_something_expensive
+    #   end
+    #
+    # :api: plugin
+    def cleanup_view_runtime #:nodoc:
+      yield
+    end
+
+    module ClassMethods
+      # This is the hook invoked by ActiveSupport::Notifications.subscribe.
+      # If you need to log any event, overwrite the method and do it here.
+      def log_event(name, before, after, instrumenter_id, payload) #:nodoc:
+        if name == :process_action
+          duration     = [(after - before) * 1000, 0.01].max
+          controller   = payload[:controller]
+          request      = controller.request
+
+          logger.info "\n\nProcessed #{controller.class.name}##{payload[:action]} " \
+            "to #{request.formats} (for #{request.remote_ip} at #{before.to_s(:db)}) " \
+            "[#{request.method.to_s.upcase}]"
+
+          log_process_action(controller)
+
+          message = "Completed in %.0fms" % duration
+          message << " | #{controller.response.status}"
+          message << " [#{request.request_uri rescue "unknown"}]"
+
+          logger.info(message)
+        elsif name == :render_template
+          # TODO Make render_template logging work if you are using just ActionView
+          duration = (after - before) * 1000
+          message = "Rendered #{payload[:identifier]}"
+          message << " within #{payload[:layout]}" if payload[:layout]
+          message << (" (%.1fms)" % duration)
+          logger.info(message)
+        end
+      end
+
+    protected
+
+      # A hook which allows logging what happened during controller process action.
+      # :api: plugin
+      def log_process_action(controller) #:nodoc:
+        view_runtime = controller.send :view_runtime
+        logger.info("  View runtime: %.1fms" % view_runtime.to_f) if view_runtime
+      end
+    end
+  end
+end
\ No newline at end of file
diff --git a/actionpack/lib/action_controller/metal/rack_convenience.rb b/actionpack/lib/action_controller/metal/rack_delegation.rb
index 131d20114d..bb55383631 100644
--- a/actionpack/lib/action_controller/metal/rack_convenience.rb
+++ b/actionpack/lib/action_controller/metal/rack_delegation.rb
@@ -1,8 +1,12 @@
+require 'action_dispatch/http/request'
+require 'action_dispatch/http/response'
+
 module ActionController
-  module RackConvenience
+  module RackDelegation
     extend ActiveSupport::Concern
 
     included do
+      delegate :session, :to => "@_request"
       delegate :headers, :status=, :location=, :content_type=,
                :status, :location, :content_type, :to => "@_response"
       attr_internal :request
@@ -23,5 +27,9 @@ module ActionController
       response.body = body if response
       super
     end
+
+    def reset_session
+      @_request.reset_session
+    end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/redirecting.rb b/actionpack/lib/action_controller/metal/redirecting.rb
new file mode 100644
index 0000000000..7a2f9a6fc5
--- /dev/null
+++ b/actionpack/lib/action_controller/metal/redirecting.rb
@@ -0,0 +1,90 @@
+module ActionController
+  class RedirectBackError < AbstractController::Error #:nodoc:
+    DEFAULT_MESSAGE = 'No HTTP_REFERER was set in the request to this action, so redirect_to :back could not be called successfully. If this is a test, make sure to specify request.env["HTTP_REFERER"].'
+
+    def initialize(message = nil)
+      super(message || DEFAULT_MESSAGE)
+    end
+  end
+
+  module Redirecting
+    extend ActiveSupport::Concern
+    include AbstractController::Logger
+
+    # Redirects the browser to the target specified in +options+. This parameter can take one of three forms:
+    #
+    # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
+    # * <tt>Record</tt> - The URL will be generated by calling url_for with the +options+, which will reference a named URL for that record.
+    # * <tt>String</tt> starting with <tt>protocol://</tt> (like <tt>http://</tt>) - Is passed straight through as the target for redirection.
+    # * <tt>String</tt> not containing a protocol - The current protocol and host is prepended to the string.
+    # * <tt>:back</tt> - Back to the page that issued the request. Useful for forms that are triggered from multiple places.
+    #   Short-hand for <tt>redirect_to(request.env["HTTP_REFERER"])</tt>
+    #
+    # Examples:
+    #   redirect_to :action => "show", :id => 5
+    #   redirect_to post
+    #   redirect_to "http://www.rubyonrails.org"
+    #   redirect_to "/images/screenshot.jpg"
+    #   redirect_to articles_url
+    #   redirect_to :back
+    #
+    # The redirection happens as a "302 Moved" header unless otherwise specified.
+    #
+    # Examples:
+    #   redirect_to post_url(@post), :status => :found
+    #   redirect_to :action=>'atom', :status => :moved_permanently
+    #   redirect_to post_url(@post), :status => 301
+    #   redirect_to :action=>'atom', :status => 302
+    #
+    # It is also possible to assign a flash message as part of the redirection. There are two special accessors for commonly used the flash names
+    # +alert+ and +notice+ as well as a general purpose +flash+ bucket.
+    #
+    # Examples:
+    #   redirect_to post_url(@post), :alert => "Watch it, mister!"
+    #   redirect_to post_url(@post), :status=> :found, :notice => "Pay attention to the road"
+    #   redirect_to post_url(@post), :status => 301, :flash => { :updated_post_id => @post.id }
+    #   redirect_to { :action=>'atom' }, :alert => "Something serious happened"
+    #
+    # When using <tt>redirect_to :back</tt>, if there is no referrer,
+    # RedirectBackError will be raised. You may specify some fallback
+    # behavior for this case by rescuing RedirectBackError.
+    def redirect_to(options = {}, response_status = {}) #:doc:
+      raise ActionControllerError.new("Cannot redirect to nil!") if options.nil?
+      raise AbstractController::DoubleRenderError if response_body
+
+      self.status        = _extract_redirect_to_status(options, response_status)
+      self.location      = _compute_redirect_to_location(options)
+      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.h(location)}\">redirected</a>.</body></html>"
+
+      logger.info("Redirected to #{location}") if logger && logger.info?
+    end
+
+    private
+      def _extract_redirect_to_status(options, response_status)
+        status = if options.is_a?(Hash) && options.key?(:status)
+          Rack::Utils.status_code(options.delete(:status))
+        elsif response_status.key?(:status)
+          Rack::Utils.status_code(response_status[:status])
+        else
+          302
+        end
+      end
+
+      def _compute_redirect_to_location(options)
+        case options
+        # The scheme name consist of a letter followed by any combination of
+        # letters, digits, and the plus ("+"), period ("."), or hyphen ("-")
+        # characters; and is terminated by a colon (":").
+        when %r{^\w[\w\d+.-]*:.*}
+          options
+        when String
+          request.protocol + request.host_with_port + options
+        when :back
+          raise RedirectBackError unless refer = request.headers["Referer"]
+          refer
+        else
+          url_for(options)
+        end.gsub(/[\r\n]/, '')
+      end
+  end
+end
diff --git a/actionpack/lib/action_controller/metal/redirector.rb b/actionpack/lib/action_controller/metal/redirector.rb
deleted file mode 100644
index b55f5e7bfc..0000000000
--- a/actionpack/lib/action_controller/metal/redirector.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-module ActionController
-  class RedirectBackError < AbstractController::Error #:nodoc:
-    DEFAULT_MESSAGE = 'No HTTP_REFERER was set in the request to this action, so redirect_to :back could not be called successfully. If this is a test, make sure to specify request.env["HTTP_REFERER"].'
-
-    def initialize(message = nil)
-      super(message || DEFAULT_MESSAGE)
-    end
-  end
-
-  module Redirector
-    extend ActiveSupport::Concern
-    include AbstractController::Logger
-
-    def redirect_to(url, status) #:doc:
-      raise AbstractController::DoubleRenderError if response_body
-      logger.info("Redirected to #{url}") if logger && logger.info?
-      self.status = status
-      self.location = url.gsub(/[\r\n]/, '')
-      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.h(url)}\">redirected</a>.</body></html>"
-    end
-  end
-end
diff --git a/actionpack/lib/action_controller/metal/render_options.rb b/actionpack/lib/action_controller/metal/render_options.rb
deleted file mode 100644
index 0d69ca10df..0000000000
--- a/actionpack/lib/action_controller/metal/render_options.rb
+++ /dev/null
@@ -1,103 +0,0 @@
-module ActionController
-  module RenderOptions
-    extend ActiveSupport::Concern
-
-    included do
-      extlib_inheritable_accessor :_renderers
-      self._renderers = []
-    end
-
-    module ClassMethods
-      def _write_render_options
-        renderers = _renderers.map do |r|
-          <<-RUBY_EVAL
-            if options.key?(:#{r})
-              _process_options(options)
-              return render_#{r}(options[:#{r}], options)
-            end
-          RUBY_EVAL
-        end
-
-        class_eval <<-RUBY_EVAL, __FILE__, __LINE__ + 1
-          def _handle_render_options(options)
-            #{renderers.join}
-          end
-        RUBY_EVAL
-      end
-
-      def _add_render_option(name)
-        _renderers << name
-        _write_render_options
-      end
-    end
-
-    def render_to_body(options)
-      _handle_render_options(options) || super
-    end
-  end
-
-  module RenderOption #:nodoc:
-    def self.extended(base)
-      base.extend ActiveSupport::Concern
-      base.send :include, ::ActionController::RenderOptions
-
-      def base.register_renderer(name)
-        included { _add_render_option(name) }
-      end
-    end
-  end
-
-  module RenderOptions
-    module Json
-      extend RenderOption
-      register_renderer :json
-
-      def render_json(json, options)
-        json = ActiveSupport::JSON.encode(json) unless json.respond_to?(:to_str)
-        json = "#{options[:callback]}(#{json})" unless options[:callback].blank?
-        self.content_type ||= Mime::JSON
-        self.response_body = json
-      end
-    end
-
-    module Js
-      extend RenderOption
-      register_renderer :js
-
-      def render_js(js, options)
-        self.content_type ||= Mime::JS
-        self.response_body  = js.respond_to?(:to_js) ? js.to_js : js
-      end
-    end
-
-    module Xml
-      extend RenderOption
-      register_renderer :xml
-
-      def render_xml(xml, options)
-        self.content_type ||= Mime::XML
-        self.response_body  = xml.respond_to?(:to_xml) ? xml.to_xml : xml
-      end
-    end
-
-    module RJS
-      extend RenderOption
-      register_renderer :update
-
-      def render_update(proc, options)
-        generator = ActionView::Helpers::PrototypeHelper::JavaScriptGenerator.new(view_context, &proc)
-        self.content_type = Mime::JS
-        self.response_body = generator.to_s
-      end
-    end
-
-    module All
-      extend ActiveSupport::Concern
-
-      include ActionController::RenderOptions::Json
-      include ActionController::RenderOptions::Js
-      include ActionController::RenderOptions::Xml
-      include ActionController::RenderOptions::RJS
-    end
-  end
-end
diff --git a/actionpack/lib/action_controller/metal/renderers.rb b/actionpack/lib/action_controller/metal/renderers.rb
new file mode 100644
index 0000000000..c1ba47927a
--- /dev/null
+++ b/actionpack/lib/action_controller/metal/renderers.rb
@@ -0,0 +1,91 @@
+module ActionController
+  def self.add_renderer(key, &block)
+    Renderers.add(key, &block)
+  end
+
+  module Renderers
+    extend ActiveSupport::Concern
+
+    included do
+      extlib_inheritable_accessor :_renderers
+      self._renderers = {}
+    end
+
+    module ClassMethods
+      def _write_render_options
+        renderers = _renderers.map do |name, value|
+          <<-RUBY_EVAL
+            if options.key?(:#{name})
+              _process_options(options)
+              return _render_option_#{name}(options[:#{name}], options)
+            end
+          RUBY_EVAL
+        end
+
+        class_eval <<-RUBY_EVAL, __FILE__, __LINE__ + 1
+          def _handle_render_options(options)
+            #{renderers.join}
+          end
+        RUBY_EVAL
+      end
+
+      def use_renderers(*args)
+        args.each do |key|
+          _renderers[key] = RENDERERS[key]
+        end
+        _write_render_options
+      end
+      alias use_renderer use_renderers
+    end
+
+    def render_to_body(options)
+      _handle_render_options(options) || super
+    end
+
+    RENDERERS = {}
+    def self.add(key, &block)
+      define_method("_render_option_#{key}", &block)
+      RENDERERS[key] = block
+      All._write_render_options
+    end
+
+    module All
+      extend ActiveSupport::Concern
+      include Renderers
+
+      INCLUDED = []
+      included do
+        self._renderers = RENDERERS
+        _write_render_options
+        INCLUDED << self
+      end
+
+      def self._write_render_options
+        INCLUDED.each(&:_write_render_options)
+      end
+    end
+
+    add :json do |json, options|
+      json = ActiveSupport::JSON.encode(json) unless json.respond_to?(:to_str)
+      json = "#{options[:callback]}(#{json})" unless options[:callback].blank?
+      self.content_type ||= Mime::JSON
+      self.response_body  = json
+    end
+
+    add :js do |js, options|
+      self.content_type ||= Mime::JS
+      self.response_body  = js.respond_to?(:to_js) ? js.to_js : js
+    end
+
+    add :xml do |xml, options|
+      self.content_type ||= Mime::XML
+      self.response_body  = xml.respond_to?(:to_xml) ? xml.to_xml : xml
+    end
+
+    add :update do |proc, options|
+      generator = ActionView::Helpers::PrototypeHelper::JavaScriptGenerator.new(view_context, &proc)
+      self.content_type = Mime::JS
+      self.response_body = generator.to_s
+    end
+  end
+end
diff --git a/actionpack/lib/action_controller/metal/rendering_controller.rb b/actionpack/lib/action_controller/metal/rendering.rb
index 237299cd30..74e50bb032 100644
--- a/actionpack/lib/action_controller/metal/rendering_controller.rb
+++ b/actionpack/lib/action_controller/metal/rendering.rb
@@ -1,9 +1,9 @@
 module ActionController
-  module RenderingController
+  module Rendering
     extend ActiveSupport::Concern
 
     included do
-      include AbstractController::RenderingController
+      include AbstractController::Rendering
       include AbstractController::LocalizedCache
     end
 
@@ -20,12 +20,6 @@ module ActionController
 
     def render_to_body(options)
       _process_options(options)
-
-      if options.key?(:partial)
-        options[:partial] = action_name if options[:partial] == true
-        options[:_details] = {:formats => formats}
-      end
-
       super
     end
 
@@ -43,6 +37,12 @@ module ActionController
         super
       end
 
+      def _render_partial(options)
+        options[:partial] = action_name if options[:partial] == true
+        options[:_details] = {:formats => formats}
+        super
+      end
+
       def format_for_text
         formats.first
       end
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
index 113c20a758..f1fb4d7ce5 100644
--- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb
+++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
@@ -5,7 +5,7 @@ module ActionController #:nodoc:
   module RequestForgeryProtection
     extend ActiveSupport::Concern
 
-    include AbstractController::Helpers, Session
+    include AbstractController::Helpers
 
     included do
       # Sets the token parameter name for RequestForgery. Calling +protect_from_forgery+
@@ -13,37 +13,37 @@ module ActionController #:nodoc:
       cattr_accessor :request_forgery_protection_token
 
       # Controls whether request forgergy protection is turned on or not. Turned off by default only in test mode.
-      class_inheritable_accessor :allow_forgery_protection
+      extlib_inheritable_accessor :allow_forgery_protection
       self.allow_forgery_protection = true
 
       helper_method :form_authenticity_token
       helper_method :protect_against_forgery?
     end
-    
-    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current 
-    # web application, not a forged link from another site, is done by embedding a token based on a random 
+
+    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current
+    # web application, not a forged link from another site, is done by embedding a token based on a random
     # string stored in the session (which an attacker wouldn't know) in all forms and Ajax requests generated
-    # by Rails and then verifying the authenticity of that token in the controller.  Only HTML/JavaScript 
-    # requests are checked, so this will not protect your XML API (presumably you'll have a different 
-    # authentication scheme there anyway).  Also, GET requests are not protected as these should be 
+    # by Rails and then verifying the authenticity of that token in the controller.  Only HTML/JavaScript
+    # requests are checked, so this will not protect your XML API (presumably you'll have a different
+    # authentication scheme there anyway).  Also, GET requests are not protected as these should be
     # idempotent anyway.
     #
     # This is turned on with the <tt>protect_from_forgery</tt> method, which will check the token and raise an
-    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the 
+    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the
     # error message in production by editing public/422.html.  A call to this method in ApplicationController is
     # generated by default in post-Rails 2.0 applications.
     #
-    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form 
-    # manually (without the use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to 
-    # include a hidden field named like that and set its value to what is returned by 
+    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form
+    # manually (without the use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to
+    # include a hidden field named like that and set its value to what is returned by
     # <tt>form_authenticity_token</tt>.
     #
-    # Request forgery protection is disabled by default in test environment. If you are upgrading from Rails 
+    # Request forgery protection is disabled by default in test environment. If you are upgrading from Rails
     # 1.x, add this to config/environments/test.rb:
     #
     #   # Disable request forgery protection in test environment
     #   config.action_controller.allow_forgery_protection = false
-    # 
+    #
     # == Learn more about CSRF (Cross-Site Request Forgery) attacks
     #
     # Here are some resources:
@@ -52,11 +52,11 @@ module ActionController #:nodoc:
     #
     # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
     # There are a few guidelines you should follow:
-    # 
+    #
     # * Keep your GET requests safe and idempotent.  More reading material:
     #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
     #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
-    #   * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look 
+    #   * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look
     #     for "Expires: at end of session"
     #
     module ClassMethods
@@ -92,7 +92,7 @@ module ActionController #:nodoc:
       # * is it a GET request?  Gets should be safe and idempotent
       # * Does the form_authenticity_token match the given token value from the params?
       def verified_request?
-        !protect_against_forgery? || request.forgery_whitelisted? || 
+        !protect_against_forgery? || request.forgery_whitelisted? ||
           form_authenticity_token == params[request_forgery_protection_token]
       end
 
@@ -101,6 +101,11 @@ module ActionController #:nodoc:
         session[:_csrf_token] ||= ActiveSupport::SecureRandom.base64(32)
       end
 
+      # The form's authenticity parameter. Override to provide your own.
+      def form_authenticity_param
+        params[request_forgery_protection_token]
+      end
+
       def protect_against_forgery?
         allow_forgery_protection
       end
diff --git a/actionpack/lib/action_controller/metal/rescuable.rb b/actionpack/lib/action_controller/metal/rescue.rb
index bbca1b2179..bbca1b2179 100644
--- a/actionpack/lib/action_controller/metal/rescuable.rb
+++ b/actionpack/lib/action_controller/metal/rescue.rb
diff --git a/actionpack/lib/action_controller/metal/responder.rb b/actionpack/lib/action_controller/metal/responder.rb
index e0932ff932..6178a59029 100644
--- a/actionpack/lib/action_controller/metal/responder.rb
+++ b/actionpack/lib/action_controller/metal/responder.rb
@@ -80,6 +80,11 @@ module ActionController #:nodoc:
   class Responder
     attr_reader :controller, :request, :format, :resource, :resources, :options
 
+    ACTIONS_FOR_VERBS = {
+      :post => :new,
+      :put => :edit
+    }
+
     def initialize(controller, resources, options={})
       @controller = controller
       @request = controller.request
@@ -102,9 +107,14 @@ module ActionController #:nodoc:
     # not defined, call to_format.
     #
     def self.call(*args)
-      responder = new(*args)
-      method = :"to_#{responder.format}"
-      responder.respond_to?(method) ? responder.send(method) : responder.to_format
+      new(*args).respond
+    end
+
+    # Main entry point for responder responsible to dispatch to the proper format.
+    #
+    def respond
+      method = :"to_#{format}"
+      respond_to?(method) ? send(method) : to_format
     end
 
     # HTML format does not render the resource, it always attempt to render a
@@ -133,7 +143,7 @@ module ActionController #:nodoc:
     def navigation_behavior(error)
       if get?
         raise error
-      elsif has_errors?
+      elsif has_errors? && default_action
         render :action => default_action
       else
         redirect_to resource_location
@@ -204,7 +214,7 @@ module ActionController #:nodoc:
     # the verb is POST.
     #
     def default_action
-      @action || (request.post? ? :new : :edit)
+      @action ||= ACTIONS_FOR_VERBS[request.method]
     end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/session.rb b/actionpack/lib/action_controller/metal/session.rb
deleted file mode 100644
index bcedd6e1c7..0000000000
--- a/actionpack/lib/action_controller/metal/session.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-module ActionController
-  module Session
-    extend ActiveSupport::Concern
-
-    include RackConvenience
-
-    def session
-      @_request.session
-    end
-
-    def reset_session
-      @_request.reset_session
-    end
-  end
-end
diff --git a/actionpack/lib/action_controller/metal/streaming.rb b/actionpack/lib/action_controller/metal/streaming.rb
index 43c661bef4..288b5d7c99 100644
--- a/actionpack/lib/action_controller/metal/streaming.rb
+++ b/actionpack/lib/action_controller/metal/streaming.rb
@@ -4,7 +4,7 @@ module ActionController #:nodoc:
   module Streaming
     extend ActiveSupport::Concern
 
-    include ActionController::RenderingController
+    include ActionController::Rendering
 
     DEFAULT_SEND_FILE_OPTIONS = {
       :type         => 'application/octet-stream'.freeze,
diff --git a/actionpack/lib/action_controller/metal/testing.rb b/actionpack/lib/action_controller/metal/testing.rb
index a4a1116d9e..c193a5eff4 100644
--- a/actionpack/lib/action_controller/metal/testing.rb
+++ b/actionpack/lib/action_controller/metal/testing.rb
@@ -2,7 +2,7 @@ module ActionController
   module Testing
     extend ActiveSupport::Concern
 
-    include RackConvenience
+    include RackDelegation
 
     # OMG MEGA HAX
     def process_with_new_base_test(request, response)
diff --git a/actionpack/lib/action_controller/metal/url_for.rb b/actionpack/lib/action_controller/metal/url_for.rb
index 14c6523045..8c3810ebcb 100644
--- a/actionpack/lib/action_controller/metal/url_for.rb
+++ b/actionpack/lib/action_controller/metal/url_for.rb
@@ -2,7 +2,7 @@ module ActionController
   module UrlFor
     extend ActiveSupport::Concern
 
-    include RackConvenience
+    include RackDelegation
 
     # Overwrite to implement a number of default options that all url_for-based methods will use. The default options should come in
     # the form of a hash, just like the one you would use for url_for directly. Example:
diff --git a/actionpack/lib/action_controller/metal/verification.rb b/actionpack/lib/action_controller/metal/verification.rb
index 500cced539..bce942b588 100644
--- a/actionpack/lib/action_controller/metal/verification.rb
+++ b/actionpack/lib/action_controller/metal/verification.rb
@@ -2,7 +2,7 @@ module ActionController #:nodoc:
   module Verification #:nodoc:
     extend ActiveSupport::Concern
 
-    include AbstractController::Callbacks, Session, Flash, RenderingController
+    include AbstractController::Callbacks, Flash, Rendering
 
     # This module provides a class-level method for specifying that certain
     # actions are guarded against being called without certain prerequisites
@@ -35,7 +35,7 @@ module ActionController #:nodoc:
     #            :add_flash => { "alert" => "Failed to create your message" },
     #            :redirect_to => :category_url
     #
-    # Note that these prerequisites are not business rules. They do not examine 
+    # Note that these prerequisites are not business rules. They do not examine
     # the content of the session or the parameters. That level of validation should
     # be encapsulated by your domain model or helper methods in the controller.
     module ClassMethods
@@ -43,40 +43,40 @@ module ActionController #:nodoc:
       # the user is redirected to a different action. The +options+ parameter
       # is a hash consisting of the following key/value pairs:
       #
-      # <tt>:params</tt>:: 
-      #   a single key or an array of keys that must be in the <tt>params</tt> 
+      # <tt>:params</tt>::
+      #   a single key or an array of keys that must be in the <tt>params</tt>
       #   hash in order for the action(s) to be safely called.
-      # <tt>:session</tt>:: 
-      #   a single key or an array of keys that must be in the <tt>session</tt> 
+      # <tt>:session</tt>::
+      #   a single key or an array of keys that must be in the <tt>session</tt>
       #   in order for the action(s) to be safely called.
-      # <tt>:flash</tt>:: 
-      #   a single key or an array of keys that must be in the flash in order 
+      # <tt>:flash</tt>::
+      #   a single key or an array of keys that must be in the flash in order
       #   for the action(s) to be safely called.
-      # <tt>:method</tt>:: 
-      #   a single key or an array of keys--any one of which must match the 
-      #   current request method in order for the action(s) to be safely called. 
-      #   (The key should be a symbol: <tt>:get</tt> or <tt>:post</tt>, for 
+      # <tt>:method</tt>::
+      #   a single key or an array of keys--any one of which must match the
+      #   current request method in order for the action(s) to be safely called.
+      #   (The key should be a symbol: <tt>:get</tt> or <tt>:post</tt>, for
       #   example.)
-      # <tt>:xhr</tt>:: 
-      #   true/false option to ensure that the request is coming from an Ajax 
-      #   call or not. 
-      # <tt>:add_flash</tt>:: 
-      #   a hash of name/value pairs that should be merged into the session's 
+      # <tt>:xhr</tt>::
+      #   true/false option to ensure that the request is coming from an Ajax
+      #   call or not.
+      # <tt>:add_flash</tt>::
+      #   a hash of name/value pairs that should be merged into the session's
       #   flash if the prerequisites cannot be satisfied.
-      # <tt>:add_headers</tt>:: 
-      #   a hash of name/value pairs that should be merged into the response's 
+      # <tt>:add_headers</tt>::
+      #   a hash of name/value pairs that should be merged into the response's
       #   headers hash if the prerequisites cannot be satisfied.
-      # <tt>:redirect_to</tt>:: 
-      #   the redirection parameters to be used when redirecting if the 
-      #   prerequisites cannot be satisfied. You can redirect either to named 
+      # <tt>:redirect_to</tt>::
+      #   the redirection parameters to be used when redirecting if the
+      #   prerequisites cannot be satisfied. You can redirect either to named
       #   route or to the action in some controller.
-      # <tt>:render</tt>:: 
+      # <tt>:render</tt>::
       #   the render parameters to be used when the prerequisites cannot be satisfied.
-      # <tt>:only</tt>:: 
-      #   only apply this verification to the actions specified in the associated 
+      # <tt>:only</tt>::
+      #   only apply this verification to the actions specified in the associated
       #   array (may also be a single value).
-      # <tt>:except</tt>:: 
-      #   do not apply this verification to the actions specified in the associated 
+      # <tt>:except</tt>::
+      #   do not apply this verification to the actions specified in the associated
       #   array (may also be a single value).
       def verify(options={})
         before_filter :only => options[:only], :except => options[:except] do
@@ -94,31 +94,31 @@ module ActionController #:nodoc:
         apply_remaining_actions(options)               unless performed?
       end
     end
-    
+
     def prereqs_invalid?(options) # :nodoc:
-      verify_presence_of_keys_in_hash_flash_or_params(options) || 
-      verify_method(options) || 
+      verify_presence_of_keys_in_hash_flash_or_params(options) ||
+      verify_method(options) ||
       verify_request_xhr_status(options)
     end
- 
+
     def verify_presence_of_keys_in_hash_flash_or_params(options) # :nodoc:
       [*options[:params] ].find { |v| v && params[v.to_sym].nil?  } ||
       [*options[:session]].find { |v| session[v].nil? } ||
       [*options[:flash]  ].find { |v| flash[v].nil?   }
     end
-    
+
     def verify_method(options) # :nodoc:
       [*options[:method]].all? { |v| request.method != v.to_sym } if options[:method]
     end
-    
+
     def verify_request_xhr_status(options) # :nodoc:
       request.xhr? != options[:xhr] unless options[:xhr].nil?
     end
-    
+
     def apply_redirect_to(redirect_to_option) # :nodoc:
       (redirect_to_option.is_a?(Symbol) && redirect_to_option != :back) ? self.__send__(redirect_to_option) : redirect_to_option
     end
-    
+
     def apply_remaining_actions(options) # :nodoc:
       case
         when options[:render]      ; render(options[:render])