Merge branch 'master' of git://github.com/rails/rails

20 files changed, 367 insertions, 420 deletions

diff --git a/actionpack/lib/action_controller/base.rb b/actionpack/lib/action_controller/base.rb
index 13139358c7..fcd3cb9bd3 100644
--- a/actionpack/lib/action_controller/base.rb
+++ b/actionpack/lib/action_controller/base.rb
@@ -15,7 +15,6 @@ module ActionController
     include ActionController::Renderers::All
     include ActionController::ConditionalGet
     include ActionController::RackDelegation
-    include ActionController::Configuration
 
     # Legacy modules
     include SessionManagement
@@ -30,35 +29,13 @@ module ActionController
     include ActionController::Verification
     include ActionController::RequestForgeryProtection
     include ActionController::Streaming
+    include ActionController::RecordIdentifier
     include ActionController::HttpAuthentication::Basic::ControllerMethods
     include ActionController::HttpAuthentication::Digest::ControllerMethods
 
     # Add instrumentations hooks at the bottom, to ensure they instrument
     # all the methods properly.
     include ActionController::Instrumentation
-
-    # TODO: Extract into its own module
-    # This should be moved together with other normalizing behavior
-    module ImplicitRender
-      def send_action(*)
-        ret = super
-        default_render unless response_body
-        ret
-      end
-
-      def default_render
-        render
-      end
-
-      def method_for_action(action_name)
-        super || begin
-          if view_paths.exists?(action_name.to_s, details_for_render, controller_path)
-            "default_render"
-          end
-        end
-      end
-    end
-
     include ImplicitRender
 
     include ActionController::Rescue
@@ -82,5 +59,9 @@ module ActionController
       filter
     end
 
+    ActionController.run_base_hooks(self)
+
   end
 end
+
+require "action_controller/deprecated/base"
diff --git a/actionpack/lib/action_controller/caching.rb b/actionpack/lib/action_controller/caching.rb
index d784138ebe..b3fa129929 100644
--- a/actionpack/lib/action_controller/caching.rb
+++ b/actionpack/lib/action_controller/caching.rb
@@ -40,28 +40,34 @@ module ActionController #:nodoc:
       autoload :Sweeping, 'action_controller/caching/sweeping'
     end
 
-    included do
-      @@cache_store = nil
-      cattr_reader :cache_store
-
-      # Defines the storage option for cached fragments
-      def self.cache_store=(store_option)
-        @@cache_store = ActiveSupport::Cache.lookup_store(store_option)
+    module ConfigMethods
+      def cache_store
+        config.cache_store
       end
 
-      include Pages, Actions, Fragments
-      include Sweeping if defined?(ActiveRecord)
+      def cache_store=(store)
+        config.cache_store = ActiveSupport::Cache.lookup_store(store)
+      end
 
-      @@perform_caching = true
-      cattr_accessor :perform_caching
-    end
+    private
 
-    module ClassMethods
       def cache_configured?
         perform_caching && cache_store
       end
     end
 
+    include ConfigMethods
+    include Pages, Actions, Fragments
+    include Sweeping if defined?(ActiveRecord)
+
+    included do
+      extend ConfigMethods
+
+      @@perform_caching = true
+      cattr_accessor :perform_caching
+    end
+
+
     def caching_allowed?
       request.get? && response.status == 200
     end
@@ -75,10 +81,5 @@ module ActionController #:nodoc:
         yield
       end
     end
-
-  private
-    def cache_configured?
-      self.class.cache_configured?
-    end
   end
 end
diff --git a/actionpack/lib/action_controller/caching/pages.rb b/actionpack/lib/action_controller/caching/pages.rb
index 5797eeebd6..fe95f0e0d7 100644
--- a/actionpack/lib/action_controller/caching/pages.rb
+++ b/actionpack/lib/action_controller/caching/pages.rb
@@ -1,5 +1,6 @@
 require 'fileutils'
 require 'uri'
+require 'active_support/core_ext/class/attribute_accessors'
 
 module ActionController #:nodoc:
   module Caching
@@ -34,27 +35,26 @@ module ActionController #:nodoc:
     # Additionally, you can expire caches using Sweepers that act on changes in the model to determine when a cache is supposed to be
     # expired.
     module Pages
-      def self.included(base) #:nodoc:
-        base.extend(ClassMethods)
-        base.class_eval do
-          @@page_cache_directory = defined?(Rails.public_path) ? Rails.public_path : ""
-          ##
-          # :singleton-method:
-          # The cache directory should be the document root for the web server and is set using <tt>Base.page_cache_directory = "/document/root"</tt>.
-          # For Rails, this directory has already been set to Rails.public_path (which is usually set to <tt>RAILS_ROOT + "/public"</tt>). Changing
-          # this setting can be useful to avoid naming conflicts with files in <tt>public/</tt>, but doing so will likely require configuring your
-          # web server to look in the new location for cached files.
-          cattr_accessor :page_cache_directory
-
-          @@page_cache_extension = '.html'
-          ##
-          # :singleton-method:
-          # Most Rails requests do not have an extension, such as <tt>/weblog/new</tt>. In these cases, the page caching mechanism will add one in
-          # order to make it easy for the cached files to be picked up properly by the web server. By default, this cache extension is <tt>.html</tt>.
-          # If you want something else, like <tt>.php</tt> or <tt>.shtml</tt>, just set Base.page_cache_extension. In cases where a request already has an
-          # extension, such as <tt>.xml</tt> or <tt>.rss</tt>, page caching will not add an extension. This allows it to work well with RESTful apps.
-          cattr_accessor :page_cache_extension
-        end
+      extend ActiveSupport::Concern
+
+      included do
+        @@page_cache_directory = defined?(Rails.public_path) ? Rails.public_path : ""
+        ##
+        # :singleton-method:
+        # The cache directory should be the document root for the web server and is set using <tt>Base.page_cache_directory = "/document/root"</tt>.
+        # For Rails, this directory has already been set to Rails.public_path (which is usually set to <tt>RAILS_ROOT + "/public"</tt>). Changing
+        # this setting can be useful to avoid naming conflicts with files in <tt>public/</tt>, but doing so will likely require configuring your
+        # web server to look in the new location for cached files.
+        cattr_accessor :page_cache_directory
+
+        @@page_cache_extension = '.html'
+        ##
+        # :singleton-method:
+        # Most Rails requests do not have an extension, such as <tt>/weblog/new</tt>. In these cases, the page caching mechanism will add one in
+        # order to make it easy for the cached files to be picked up properly by the web server. By default, this cache extension is <tt>.html</tt>.
+        # If you want something else, like <tt>.php</tt> or <tt>.shtml</tt>, just set Base.page_cache_extension. In cases where a request already has an
+        # extension, such as <tt>.xml</tt> or <tt>.rss</tt>, page caching will not add an extension. This allows it to work well with RESTful apps.
+        cattr_accessor :page_cache_extension
       end
 
       module ClassMethods
@@ -121,10 +121,10 @@ module ActionController #:nodoc:
         if options.is_a?(Hash)
           if options[:action].is_a?(Array)
             options[:action].dup.each do |action|
-              self.class.expire_page(url_for(options.merge(:only_path => true, :skip_relative_url_root => true, :action => action)))
+              self.class.expire_page(url_for(options.merge(:only_path => true, :action => action)))
             end
           else
-            self.class.expire_page(url_for(options.merge(:only_path => true, :skip_relative_url_root => true)))
+            self.class.expire_page(url_for(options.merge(:only_path => true)))
           end
         else
           self.class.expire_page(options)
@@ -139,7 +139,7 @@ module ActionController #:nodoc:
 
         path = case options
           when Hash
-            url_for(options.merge(:only_path => true, :skip_relative_url_root => true, :format => params[:format]))
+            url_for(options.merge(:only_path => true, :format => params[:format]))
           when String
             options
           else
diff --git a/actionpack/lib/action_controller/caching/sweeping.rb b/actionpack/lib/action_controller/caching/sweeping.rb
index 871f41bfdd..cf16417e84 100644
--- a/actionpack/lib/action_controller/caching/sweeping.rb
+++ b/actionpack/lib/action_controller/caching/sweeping.rb
@@ -30,9 +30,7 @@ module ActionController #:nodoc:
     #     cache_sweeper OpenBar::Sweeper, :only => [ :edit, :destroy, :share ]
     #   end
     module Sweeping
-      def self.included(base) #:nodoc:
-        base.extend(ClassMethods)
-      end
+      extend ActiveSupport::Concern
 
       module ClassMethods #:nodoc:
         def cache_sweeper(*sweepers)
diff --git a/actionpack/lib/action_controller/deprecated/base.rb b/actionpack/lib/action_controller/deprecated/base.rb
new file mode 100644
index 0000000000..1d05b3fbd6
--- /dev/null
+++ b/actionpack/lib/action_controller/deprecated/base.rb
@@ -0,0 +1,131 @@
+module ActionController
+  class Base
+    class << self
+      def deprecated_config_accessor(option, message = nil)
+        deprecated_config_reader(option, message)
+        deprecated_config_writer(option, message)
+      end
+
+      def deprecated_config_reader(option, message = nil)
+        message ||= "Reading #{option} directly from ActionController::Base is deprecated. " \
+                    "Please read it from config.#{option}"
+
+        self.class_eval <<-RUBY, __FILE__, __LINE__ + 1
+          def #{option}
+            ActiveSupport::Deprecation.warn #{message.inspect}, caller
+            config.#{option}
+          end
+        RUBY
+      end
+
+      def deprecated_config_writer(option, message = nil)
+        message ||= "Setting #{option} directly on ActionController::Base is deprecated. " \
+                    "Please set it on config.action_controller.#{option}"
+
+        self.class_eval <<-RUBY, __FILE__, __LINE__ + 1
+          def #{option}=(val)
+            ActiveSupport::Deprecation.warn #{message.inspect}, caller
+            config.#{option} = val
+          end
+        RUBY
+      end
+
+      def consider_all_requests_local
+        ActiveSupport::Deprecation.warn "ActionController::Base.consider_all_requests_local is deprecated, " <<
+          "use Rails.application.config.consider_all_requests_local instead", caller
+        Rails.application.config.consider_all_requests_local
+      end
+
+      def consider_all_requests_local=(value)
+        ActiveSupport::Deprecation.warn "ActionController::Base.consider_all_requests_local= is deprecated. " <<
+          "Please configure it on your application with config.consider_all_requests_local=", caller
+        Rails.application.config.consider_all_requests_local = value
+      end
+
+      def allow_concurrency
+        ActiveSupport::Deprecation.warn "ActionController::Base.allow_concurrency is deprecated, " <<
+          "use Rails.application.config.allow_concurrency instead", caller
+        Rails.application.config.allow_concurrency
+      end
+
+      def allow_concurrency=(value)
+        ActiveSupport::Deprecation.warn "ActionController::Base.allow_concurrency= is deprecated. " <<
+          "Please configure it on your application with config.allow_concurrency=", caller
+        Rails.application.config.allow_concurrency = value
+      end
+
+      def ip_spoofing_check=(value)
+        ActiveSupport::Deprecation.warn "ActionController::Base.ip_spoofing_check= is deprecated. " <<
+          "Please configure it on your application with config.action_dispatch.ip_spoofing_check=", caller
+        Rails.application.config.action_dispatch.ip_spoofing_check = value
+      end
+
+      def ip_spoofing_check
+        ActiveSupport::Deprecation.warn "ActionController::Base.ip_spoofing_check is deprecated. " <<
+          "Configuring ip_spoofing_check on the application configures a middleware.", caller
+        Rails.application.config.action_disaptch.ip_spoofing_check
+      end
+
+      def trusted_proxies=(value)
+        ActiveSupport::Deprecation.warn "ActionController::Base.trusted_proxies= is deprecated. " <<
+          "Please configure it on your application with config.action_dispatch.trusted_proxies=", caller
+        Rails.application.config.action_dispatch.ip_spoofing_check = value
+      end
+
+      def trusted_proxies
+        ActiveSupport::Deprecation.warn "ActionController::Base.trusted_proxies is deprecated. " <<
+          "Configuring trusted_proxies on the application configures a middleware.", caller
+        Rails.application.config.action_dispatch.ip_spoofing_check = value
+      end
+
+      def session(*args)
+        ActiveSupport::Deprecation.warn(
+          "Disabling sessions for a single controller has been deprecated. " +
+          "Sessions are now lazy loaded. So if you don't access them, " +
+          "consider them off. You can still modify the session cookie " +
+          "options with request.session_options.", caller)
+      end
+
+      def session=(value)
+        ActiveSupport::Deprecation.warn "ActionController::Base.session= is deprecated. " <<
+          "Please configure it on your application with config.session_store :cookie_store, :key => '....'", caller
+        if value.delete(:disabled)
+          Rails.application.config.session_store :disabled
+        else
+          store = Rails.application.config.session_store
+          Rails.application.config.session_store store, value
+        end
+      end
+
+      # Controls the resource action separator
+      def resource_action_separator
+        @resource_action_separator ||= "/"
+      end
+
+      def resource_action_separator=(val)
+        ActiveSupport::Deprecation.warn "ActionController::Base.resource_action_separator is deprecated and only " \
+                                        "works with the deprecated router DSL."
+        @resource_action_separator = val
+      end
+
+      def use_accept_header
+        ActiveSupport::Deprecation.warn "ActionController::Base.use_accept_header doesn't do anything anymore. " \
+                                        "The accept header is always taken into account."
+      end
+
+      def use_accept_header=(val)
+        use_accept_header
+      end
+    end
+
+    deprecated_config_writer :session_store
+    deprecated_config_writer :session_options
+    deprecated_config_accessor :relative_url_root, "relative_url_root is ineffective. Please stop using it"
+    deprecated_config_accessor :assets_dir
+    deprecated_config_accessor :javascripts_dir
+    deprecated_config_accessor :stylesheets_dir
+
+    delegate :consider_all_requests_local, :consider_all_requests_local=,
+             :allow_concurrency, :allow_concurrency=, :to => :"self.class"
+  end
+end
\ No newline at end of file
diff --git a/actionpack/lib/action_controller/metal.rb b/actionpack/lib/action_controller/metal.rb
index 4fd37e7f31..eebd2c943a 100644
--- a/actionpack/lib/action_controller/metal.rb
+++ b/actionpack/lib/action_controller/metal.rb
@@ -34,7 +34,8 @@ module ActionController
     # and response object available. You might wish to control the
     # environment and response manually for performance reasons.
 
-    attr_internal :status, :headers, :content_type, :response
+    attr_internal :status, :headers, :content_type, :response, :request
+    delegate :session, :to => "@_request"
 
     def initialize(*)
       @_headers = {}
@@ -66,8 +67,9 @@ module ActionController
     end
 
     # :api: private
-    def dispatch(name, env)
-      @_env = env
+    def dispatch(name, request)
+      @_request = request
+      @_env = request.env
       @_env['action_controller.instance'] = self
       process(name)
       to_a
@@ -78,31 +80,12 @@ module ActionController
       response ? response.to_a : [status, headers, response_body]
     end
 
-    class ActionEndpoint
-      @@endpoints = Hash.new {|h,k| h[k] = Hash.new {|sh,sk| sh[sk] = {} } }
-
-      def self.for(controller, action, stack)
-        @@endpoints[controller][action][stack] ||= begin
-          endpoint = new(controller, action)
-          stack.build(endpoint)
-        end
-      end
-
-      def initialize(controller, action)
-        @controller, @action = controller, action
-        @_formats = [Mime::HTML]
-      end
-
-      def call(env)
-        @controller.new.dispatch(@action, env)
-      end
-    end
-
     class_attribute :middleware_stack
     self.middleware_stack = ActionDispatch::MiddlewareStack.new
 
     def self.inherited(base)
       self.middleware_stack = base.middleware_stack.dup
+      super
     end
 
     def self.use(*args)
@@ -126,8 +109,10 @@ module ActionController
     #
     # ==== Returns
     # Proc:: A rack application
-    def self.action(name)
-      ActionEndpoint.for(self, name, middleware_stack)
+    def self.action(name, klass = ActionDispatch::Request)
+      middleware_stack.build do |env|
+        new.dispatch(name, klass.new(env))
+      end
     end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/compatibility.rb b/actionpack/lib/action_controller/metal/compatibility.rb
index 2b1ada1426..ab8d87b2c4 100644
--- a/actionpack/lib/action_controller/metal/compatibility.rb
+++ b/actionpack/lib/action_controller/metal/compatibility.rb
@@ -2,21 +2,20 @@ module ActionController
   module Compatibility
     extend ActiveSupport::Concern
 
-    include AbstractController::Compatibility
-
     class ::ActionController::ActionControllerError < StandardError #:nodoc:
     end
 
+    module ClassMethods
+    end
+
     # Temporary hax
     included do
       ::ActionController::UnknownAction = ::AbstractController::ActionNotFound
       ::ActionController::DoubleRenderError = ::AbstractController::DoubleRenderError
 
-      cattr_accessor :session_options
-      self.session_options = {}
-
-      cattr_accessor :relative_url_root
-      self.relative_url_root = ENV['RAILS_RELATIVE_URL_ROOT']
+      # ROUTES TODO: This should be handled by a middleware and route generation
+      # should be able to handle SCRIPT_NAME
+      self.config.relative_url_root = ENV['RAILS_RELATIVE_URL_ROOT']
 
       class << self
         delegate :default_charset=, :to => "ActionDispatch::Response"
@@ -30,31 +29,17 @@ module ActionController
                                              @before_filter_chain_aborted @_headers @_params
                                              @_response)
 
-      # Controls the resource action separator
-      cattr_accessor :resource_action_separator
-      self.resource_action_separator = "/"
-
-      cattr_accessor :use_accept_header
-      self.use_accept_header = true
+      def rescue_action(env)
+        raise env["action_dispatch.rescue.exception"]
+      end
 
       self.page_cache_directory = defined?(Rails.public_path) ? Rails.public_path : ""
-
-      # Prepends all the URL-generating helpers from AssetHelper. This makes it possible to easily move javascripts, stylesheets,
-      # and images to a dedicated asset server away from the main web server. Example:
-      #   ActionController::Base.asset_host = "http://assets.example.com"
-      cattr_accessor :asset_host
-
-      cattr_accessor :ip_spoofing_check
-      self.ip_spoofing_check = true
-
-      cattr_accessor :trusted_proxies
     end
 
     # For old tests
     def initialize_template_class(*) end
     def assign_shortcuts(*) end
 
-    # TODO: Remove this after we flip
     def template
       @template ||= view_context
     end
@@ -64,52 +49,20 @@ module ActionController
       super
     end
 
-    module ClassMethods
-      def consider_all_requests_local
-        ActiveSupport::Deprecation.warn "ActionController::Base.consider_all_requests_local is deprecated, " <<
-          "use Rails.application.config.consider_all_requests_local instead"
-        Rails.application.config.consider_all_requests_local
-      end
-
-      def consider_all_requests_local=(value)
-        ActiveSupport::Deprecation.warn "ActionController::Base.consider_all_requests_local= is no longer effective. " <<
-          "Please configure it on your application with config.consider_all_requests_local="
-        Rails.application.config.consider_all_requests_local = value
-      end
-
-      def allow_concurrency
-        ActiveSupport::Deprecation.warn "ActionController::Base.allow_concurrency is deprecated, " <<
-          "use Rails.application.config.allow_concurrency instead"
-        Rails.application.config.allow_concurrency
-      end
-
-      def allow_concurrency=(value)
-        ActiveSupport::Deprecation.warn "ActionController::Base.allow_concurrency= is no longer effective. " <<
-          "Please configure it on your application with config.allow_concurrency="
-        Rails.application.config.allow_concurrency = value
-      end
-
-      def rescue_action(env)
-        raise env["action_dispatch.rescue.exception"]
-      end
-
-      # Defines the storage option for cached fragments
-      def cache_store=(store_option)
-        @@cache_store = ActiveSupport::Cache.lookup_store(store_option)
-      end
-    end
-
-    delegate :consider_all_requests_local, :consider_all_requests_local=,
-             :allow_concurrency, :allow_concurrency=, :to => :"self.class"
-
-    def render_to_body(options)
-      if options.is_a?(Hash) && options.key?(:template)
-        options[:template].sub!(/^\//, '')
+    def _normalize_options(options)
+      if options[:action] && options[:action].to_s.include?(?/)
+        ActiveSupport::Deprecation.warn "Giving a path to render :action is deprecated. " <<
+          "Please use render :template instead", caller
+        options[:template] = options.delete(:action)
       end
 
       options[:text] = nil if options.delete(:nothing) == true
       options[:text] = " " if options.key?(:text) && options[:text].nil?
+      super
+    end
 
+    def render_to_body(options)
+      options[:template].sub!(/^\//, '') if options.key?(:template)
       super || " "
     end
 
@@ -124,18 +77,5 @@ module ActionController
     def performed?
       response_body
     end
-
-    # ==== Request only view path switching ====
-    def append_view_path(path)
-      view_paths.push(*path)
-    end
-
-    def prepend_view_path(path)
-      view_paths.unshift(*path)
-    end
-
-    def view_paths
-      view_context.view_paths
-    end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/configuration.rb b/actionpack/lib/action_controller/metal/configuration.rb
deleted file mode 100644
index 5c829853b7..0000000000
--- a/actionpack/lib/action_controller/metal/configuration.rb
+++ /dev/null
@@ -1,28 +0,0 @@
-module ActionController
-  module Configuration
-    extend ActiveSupport::Concern
-    
-    def config
-      @config ||= self.class.config
-    end
-    
-    def config=(config)
-      @config = config
-    end
-    
-    module ClassMethods
-      def default_config
-        @default_config ||= {}
-      end
-      
-      def config
-        self.config ||= default_config
-      end
-      
-      def config=(config)
-        @config = ActiveSupport::OrderedHash.new
-        @config.merge!(config)
-      end
-    end
-  end
-end
\ No newline at end of file
diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb
index 0f35a7c040..6ec788f302 100644
--- a/actionpack/lib/action_controller/metal/http_authentication.rb
+++ b/actionpack/lib/action_controller/metal/http_authentication.rb
@@ -124,7 +124,7 @@ module ActionController
       end
 
       def authenticate(request, &login_procedure)
-        unless authorization(request).blank?
+        unless request.authorization.blank?
           login_procedure.call(*user_name_and_password(request))
         end
       end
@@ -133,15 +133,8 @@ module ActionController
         decode_credentials(request).split(/:/, 2)
       end
 
-      def authorization(request)
-        request.env['HTTP_AUTHORIZATION']   ||
-        request.env['X-HTTP_AUTHORIZATION'] ||
-        request.env['X_HTTP_AUTHORIZATION'] ||
-        request.env['REDIRECT_X_HTTP_AUTHORIZATION']
-      end
-
       def decode_credentials(request)
-        ActiveSupport::Base64.decode64(authorization(request).split(' ', 2).last || '')
+        ActiveSupport::Base64.decode64(request.authorization.split(' ', 2).last || '')
       end
 
       def encode_credentials(user_name, password)
@@ -165,7 +158,7 @@ module ActionController
 
         # Authenticate with HTTP Digest, returns true or false
         def authenticate_with_http_digest(realm = "Application", &password_procedure)
-          HttpAuthentication::Digest.authenticate(request, realm, &password_procedure)
+          HttpAuthentication::Digest.authenticate(config.secret, request, realm, &password_procedure)
         end
 
         # Render output including the HTTP Digest authentication header
@@ -175,30 +168,23 @@ module ActionController
       end
 
       # Returns false on a valid response, true otherwise
-      def authenticate(request, realm, &password_procedure)
-        authorization(request) && validate_digest_response(request, realm, &password_procedure)
-      end
-
-      def authorization(request)
-        request.env['HTTP_AUTHORIZATION']   ||
-        request.env['X-HTTP_AUTHORIZATION'] ||
-        request.env['X_HTTP_AUTHORIZATION'] ||
-        request.env['REDIRECT_X_HTTP_AUTHORIZATION']
+      def authenticate(secret_key, request, realm, &password_procedure)
+        request.authorization && validate_digest_response(secret_key, request, realm, &password_procedure)
       end
 
       # Returns false unless the request credentials response value matches the expected value.
       # First try the password as a ha1 digest password. If this fails, then try it as a plain
       # text password.
-      def validate_digest_response(request, realm, &password_procedure)
+      def validate_digest_response(secret_key, request, realm, &password_procedure)
         credentials = decode_credentials_header(request)
-        valid_nonce = validate_nonce(request, credentials[:nonce])
+        valid_nonce = validate_nonce(secret_key, request, credentials[:nonce])
 
-        if valid_nonce && realm == credentials[:realm] && opaque == credentials[:opaque]
+        if valid_nonce && realm == credentials[:realm] && opaque(secret_key) == credentials[:opaque]
           password = password_procedure.call(credentials[:username])
           return false unless password
 
           method = request.env['rack.methodoverride.original_method'] || request.env['REQUEST_METHOD']
-          uri    = credentials[:uri][0,1] == '/' ? request.request_uri : request.url
+          uri    = credentials[:uri][0,1] == '/' ? request.fullpath : request.url
 
          [true, false].any? do |password_is_ha1|
            expected = expected_response(method, uri, credentials, password, password_is_ha1)
@@ -226,7 +212,7 @@ module ActionController
       end
 
       def decode_credentials_header(request)
-        decode_credentials(authorization(request))
+        decode_credentials(request.authorization)
       end
 
       def decode_credentials(header)
@@ -238,6 +224,9 @@ module ActionController
       end
 
       def authentication_header(controller, realm)
+        secret_key = controller.config.secret
+        nonce = self.nonce(secret_key)
+        opaque = opaque(secret_key)
         controller.headers["WWW-Authenticate"] = %(Digest realm="#{realm}", qop="auth", algorithm=MD5, nonce="#{nonce}", opaque="#{opaque}")
       end
 
@@ -280,7 +269,7 @@ module ActionController
       # The nonce is opaque to the client. Composed of Time, and hash of Time with secret
       # key from the Rails session secret generated upon creation of project. Ensures
       # the time cannot be modified by client.
-      def nonce(time = Time.now)
+      def nonce(secret_key, time = Time.now)
         t = time.to_i
         hashed = [t, secret_key]
         digest = ::Digest::MD5.hexdigest(hashed.join(":"))
@@ -292,21 +281,16 @@ module ActionController
       # Can be much shorter if the Stale directive is implemented. This would
       # allow a user to use new nonce without prompting user again for their
       # username and password.
-      def validate_nonce(request, value, seconds_to_timeout=5*60)
+      def validate_nonce(secret_key, request, value, seconds_to_timeout=5*60)
         t = ActiveSupport::Base64.decode64(value).split(":").first.to_i
-        nonce(t) == value && (t - Time.now.to_i).abs <= seconds_to_timeout
+        nonce(secret_key, t) == value && (t - Time.now.to_i).abs <= seconds_to_timeout
       end
 
       # Opaque based on random generation - but changing each request?
-      def opaque()
+      def opaque(secret_key)
         ::Digest::MD5.hexdigest(secret_key)
       end
 
-      # Set in /initializers/session_store.rb, and loaded even if sessions are not in use.
-      def secret_key
-        ActionController::Base.session_options[:secret]
-      end
-
     end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/implicit_render.rb b/actionpack/lib/action_controller/metal/implicit_render.rb
new file mode 100644
index 0000000000..282dcf66b3
--- /dev/null
+++ b/actionpack/lib/action_controller/metal/implicit_render.rb
@@ -0,0 +1,21 @@
+module ActionController
+  module ImplicitRender
+    def send_action(*)
+      ret = super
+      default_render unless response_body
+      ret
+    end
+
+    def default_render
+      render
+    end
+
+    def method_for_action(action_name)
+      super || begin
+        if template_exists?(action_name.to_s, _prefix)
+          "default_render"
+        end
+      end
+    end
+  end
+end
\ No newline at end of file
diff --git a/actionpack/lib/action_controller/metal/instrumentation.rb b/actionpack/lib/action_controller/metal/instrumentation.rb
index 85035dc09c..d69de65f28 100644
--- a/actionpack/lib/action_controller/metal/instrumentation.rb
+++ b/actionpack/lib/action_controller/metal/instrumentation.rb
@@ -20,7 +20,7 @@ module ActionController
         :params     => request.filtered_parameters,
         :formats    => request.formats.map(&:to_sym),
         :method     => request.method,
-        :path       => (request.request_uri rescue "unknown")
+        :path       => (request.fullpath rescue "unknown")
       }
 
       ActiveSupport::Notifications.instrument("action_controller.start_processing", raw_payload.dup)
diff --git a/actionpack/lib/action_controller/metal/rack_delegation.rb b/actionpack/lib/action_controller/metal/rack_delegation.rb
index bb55383631..37106733cb 100644
--- a/actionpack/lib/action_controller/metal/rack_delegation.rb
+++ b/actionpack/lib/action_controller/metal/rack_delegation.rb
@@ -6,14 +6,11 @@ module ActionController
     extend ActiveSupport::Concern
 
     included do
-      delegate :session, :to => "@_request"
       delegate :headers, :status=, :location=, :content_type=,
                :status, :location, :content_type, :to => "@_response"
-      attr_internal :request
     end
 
-    def dispatch(action, env)
-      @_request = ActionDispatch::Request.new(env)
+    def dispatch(action, request)
       @_response = ActionDispatch::Response.new
       @_response.request = request
       super
diff --git a/actionpack/lib/action_controller/metal/rendering.rb b/actionpack/lib/action_controller/metal/rendering.rb
index 00a09309bf..f892bd9b91 100644
--- a/actionpack/lib/action_controller/metal/rendering.rb
+++ b/actionpack/lib/action_controller/metal/rendering.rb
@@ -4,44 +4,27 @@ module ActionController
 
     include ActionController::RackDelegation
     include AbstractController::Rendering
-    include AbstractController::DetailsCache
 
-    def process_action(*)
-      self.formats = request.formats.map {|x| x.to_sym }
+    def process(*)
+      self.formats = request.formats.map { |x| x.to_sym }
       super
     end
 
     def render(*args)
       raise ::AbstractController::DoubleRenderError if response_body
-      args << {} unless args.last.is_a?(Hash)
-      super(*args)
-      self.content_type ||= args.last[:_template].mime_type.to_s
+      super
       response_body
     end
 
     private
 
-      def _render_partial(options)
-        options[:partial] = action_name if options[:partial] == true
-        options[:_details] = details_for_render
-        super
-      end
-
-      def format_for_text
-        formats.first
+      def _normalize_args(action=nil, options={}, &blk)
+        options = super
+        options[:update] = blk if block_given?
+        options
       end
 
-      def _normalize_options(action=nil, options={}, &blk)
-        case action
-        when NilClass
-        when Hash
-          options = super(action.delete(:action), action)
-        when String, Symbol
-          options = super
-        else
-          options.merge! :partial => action
-        end
-
+      def _normalize_options(options)
         if options.key?(:text) && options[:text].respond_to?(:to_text)
           options[:text] = options[:text].to_text
         end
@@ -50,17 +33,23 @@ module ActionController
           options[:status] = Rack::Utils.status_code(options[:status])
         end
 
-        options[:update] = blk if block_given?
-
-        _process_options(options)
-        options
+        super
       end
 
       def _process_options(options)
         status, content_type, location = options.values_at(:status, :content_type, :location)
+
         self.status = status if status
         self.content_type = content_type if content_type
         self.headers["Location"] = url_for(location) if location
+
+        super
       end
+
+      def _with_template_hook(template)
+        super
+        self.content_type ||= template.mime_type.to_s
+      end
+
   end
 end
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
index 276c703307..6765314df2 100644
--- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb
+++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
@@ -12,11 +12,10 @@ module ActionController #:nodoc:
     included do
       # Sets the token parameter name for RequestForgery. Calling +protect_from_forgery+
       # sets it to <tt>:authenticity_token</tt> by default.
-      cattr_accessor :request_forgery_protection_token
+      config.request_forgery_protection_token ||= true
 
       # Controls whether request forgergy protection is turned on or not. Turned off by default only in test mode.
-      class_attribute :allow_forgery_protection
-      self.allow_forgery_protection = true
+      config.allow_forgery_protection ||= true
 
       helper_method :form_authenticity_token
       helper_method :protect_against_forgery?
@@ -80,9 +79,47 @@ module ActionController #:nodoc:
         self.request_forgery_protection_token ||= :authenticity_token
         before_filter :verify_authenticity_token, options
       end
+
+      def request_forgery_protection_token
+        config.request_forgery_protection_token
+      end
+
+      def request_forgery_protection_token=(val)
+        config.request_forgery_protection_token = val
+      end
+
+      def allow_forgery_protection
+        config.allow_forgery_protection
+      end
+
+      def allow_forgery_protection=(val)
+        config.allow_forgery_protection = val
+      end
     end
 
     protected
+
+      def protect_from_forgery(options = {})
+        self.request_forgery_protection_token ||= :authenticity_token
+        before_filter :verify_authenticity_token, options
+      end
+
+      def request_forgery_protection_token
+        config.request_forgery_protection_token
+      end
+
+      def request_forgery_protection_token=(val)
+        config.request_forgery_protection_token = val
+      end
+
+      def allow_forgery_protection
+        config.allow_forgery_protection
+      end
+
+      def allow_forgery_protection=(val)
+        config.allow_forgery_protection = val
+      end
+
       # The actual before_filter that is used.  Modify this to change how you handle unverified requests.
       def verify_authenticity_token
         verified_request? || raise(ActionController::InvalidAuthenticityToken)
@@ -109,7 +146,7 @@ module ActionController #:nodoc:
       end
 
       def protect_against_forgery?
-        self.class.allow_forgery_protection
+        config.allow_forgery_protection
       end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/session_management.rb b/actionpack/lib/action_controller/metal/session_management.rb
index d70f40ce7a..91d89ff9a4 100644
--- a/actionpack/lib/action_controller/metal/session_management.rb
+++ b/actionpack/lib/action_controller/metal/session_management.rb
@@ -2,44 +2,8 @@ module ActionController #:nodoc:
   module SessionManagement #:nodoc:
     extend ActiveSupport::Concern
 
-    include ActionController::Configuration
-
     module ClassMethods
-      # Set the session store to be used for keeping the session data between requests.
-      # By default, sessions are stored in browser cookies (<tt>:cookie_store</tt>),
-      # but you can also specify one of the other included stores (<tt>:active_record_store</tt>,
-      # <tt>:mem_cache_store</tt>, or your own custom class.
-      def session_store=(store)
-        if store == :active_record_store
-          self.session_store = ActiveRecord::SessionStore
-        else
-          @@session_store = store.is_a?(Symbol) ?
-            ActionDispatch::Session.const_get(store.to_s.camelize) :
-            store
-        end
-      end
-
-      # Returns the session store class currently used.
-      def session_store
-        if defined? @@session_store
-          @@session_store
-        else
-          ActionDispatch::Session::CookieStore
-        end
-      end
-
-      def session=(options = {})
-        self.session_store = nil if options.delete(:disabled)
-        session_options.merge!(options)
-      end
 
-      def session(*args)
-        ActiveSupport::Deprecation.warn(
-          "Disabling sessions for a single controller has been deprecated. " +
-          "Sessions are now lazy loaded. So if you don't access them, " +
-          "consider them off. You can still modify the session cookie " +
-          "options with request.session_options.", caller)
-      end
     end
   end
 end
diff --git a/actionpack/lib/action_controller/metal/url_for.rb b/actionpack/lib/action_controller/metal/url_for.rb
index 8a06f34d23..10c7ca9021 100644
--- a/actionpack/lib/action_controller/metal/url_for.rb
+++ b/actionpack/lib/action_controller/metal/url_for.rb
@@ -3,14 +3,13 @@ module ActionController
     extend ActiveSupport::Concern
 
     include ActionDispatch::Routing::UrlFor
-    include ActionController::RackDelegation
 
     def url_options
       super.reverse_merge(
         :host => request.host_with_port,
         :protocol => request.protocol,
         :_path_segments => request.symbolized_path_parameters
-      )
+      ).merge(:script_name => request.script_name)
     end
 
     def _router
diff --git a/actionpack/lib/action_controller/middleware.rb b/actionpack/lib/action_controller/middleware.rb
index 17275793b7..2115b07b3e 100644
--- a/actionpack/lib/action_controller/middleware.rb
+++ b/actionpack/lib/action_controller/middleware.rb
@@ -6,7 +6,8 @@ module ActionController
       end
 
       def call(env)
-        @controller.build(@app).dispatch(:index, env)
+        request = ActionDispatch::Request.new(env)
+        @controller.build(@app).dispatch(:index, request)
       end
     end
 
diff --git a/actionpack/lib/action_controller/railtie.rb b/actionpack/lib/action_controller/railtie.rb
index 07c6b8f2b6..6a3afbb157 100644
--- a/actionpack/lib/action_controller/railtie.rb
+++ b/actionpack/lib/action_controller/railtie.rb
@@ -3,6 +3,7 @@ require "action_controller"
 require "action_view/railtie"
 require "active_support/core_ext/class/subclasses"
 require "active_support/deprecation/proxy_wrappers"
+require "active_support/deprecation"
 
 module ActionController
   class Railtie < Rails::Railtie
@@ -11,28 +12,63 @@ module ActionController
     require "action_controller/railties/log_subscriber"
     require "action_controller/railties/url_helpers"
 
+    ad = config.action_dispatch
+    config.action_controller.singleton_class.send(:define_method, :session) do
+      ActiveSupport::Deprecation.warn "config.action_controller.session has been " \
+        "renamed to config.action_dispatch.session.", caller
+      ad.session
+    end
+
+    config.action_controller.singleton_class.send(:define_method, :session=) do |val|
+      ActiveSupport::Deprecation.warn "config.action_controller.session has been " \
+        "renamed to config.action_dispatch.session.", caller
+      ad.session = val
+    end
+
+    config.action_controller.singleton_class.send(:define_method, :session_store) do
+      ActiveSupport::Deprecation.warn "config.action_controller.session_store has been " \
+        "renamed to config.action_dispatch.session_store.", caller
+      ad.session_store
+    end
+
+    config.action_controller.singleton_class.send(:define_method, :session_store=) do |val|
+      ActiveSupport::Deprecation.warn "config.action_controller.session_store has been " \
+        "renamed to config.action_dispatch.session_store.", caller
+      ad.session_store = val
+    end
+
     log_subscriber ActionController::Railties::LogSubscriber.new
 
     initializer "action_controller.logger" do
-      ActionController::Base.logger ||= Rails.logger
+      ActionController.base_hook { self.logger ||= Rails.logger }
     end
 
     initializer "action_controller.set_configs" do |app|
-      app.config.action_controller.each do |k,v|
-        ActionController::Base.send "#{k}=", v
-      end
+      paths = app.config.paths
+      ac = app.config.action_controller
+
+      ac.assets_dir      = paths.public.to_a.first
+      ac.javascripts_dir = paths.public.javascripts.to_a.first
+      ac.stylesheets_dir = paths.public.stylesheets.to_a.first
+      ac.secret          = app.config.cookie_secret
+
+      ActionController.base_hook { self.config.replace(ac) }
     end
 
     initializer "action_controller.initialize_framework_caches" do
-      ActionController::Base.cache_store ||= RAILS_CACHE
+      ActionController.base_hook { self.cache_store ||= RAILS_CACHE }
     end
 
     initializer "action_controller.set_helpers_path" do |app|
-      ActionController::Base.helpers_path = app.config.paths.app.helpers.to_a
+      ActionController.base_hook do
+        self.helpers_path = app.config.paths.app.helpers.to_a
+      end
     end
 
     initializer "action_controller.url_helpers" do |app|
-      ActionController::Base.extend ::ActionController::Railtie::UrlHelpers.with(app.routes)
+      ActionController.base_hook do
+        extend ::ActionController::Railtie::UrlHelpers.with(app.routes)
+      end
 
       message = "ActionController::Routing::Routes is deprecated. " \
                 "Instead, use Rails.application.routes"
diff --git a/actionpack/lib/action_controller/test_case.rb b/actionpack/lib/action_controller/test_case.rb
index 64d9bdab2a..cdb5db32aa 100644
--- a/actionpack/lib/action_controller/test_case.rb
+++ b/actionpack/lib/action_controller/test_case.rb
@@ -322,6 +322,8 @@ module ActionController
         @controller ||= klass.new rescue nil
       end
 
+      @request.env.delete('PATH_INFO')
+
       if @controller
         @controller.request = @request
         @controller.params = {}
@@ -335,13 +337,20 @@ module ActionController
 
     private
       def build_request_uri(action, parameters)
-        unless @request.env['REQUEST_URI']
+        unless @request.env["PATH_INFO"]
           options = @controller.__send__(:url_options).merge(parameters)
-          options.update(:only_path => true, :action => action)
+          options.update(
+            :only_path => true,
+            :action => action,
+            :relative_url_root => nil,
+            :_path_segments => @request.symbolized_path_parameters)
+
+          url, query_string = @router.url_for(options).split("?", 2)
 
-          url = ActionController::UrlRewriter.new(@request, parameters)
-          @request.request_uri = url.rewrite(@router, options)
+          @request.env["SCRIPT_NAME"] = @controller.config.relative_url_root
+          @request.env["PATH_INFO"] = url
+          @request.env["QUERY_STRING"] = query_string || ""
         end
       end
-  end
+    end
 end
diff --git a/actionpack/lib/action_controller/url_rewriter.rb b/actionpack/lib/action_controller/url_rewriter.rb
deleted file mode 100644
index 807b21cd0e..0000000000
--- a/actionpack/lib/action_controller/url_rewriter.rb
+++ /dev/null
@@ -1,98 +0,0 @@
-require 'active_support/core_ext/hash/except'
-
-module ActionController
-  # Rewrites URLs for Base.redirect_to and Base.url_for in the controller.
-  class UrlRewriter #:nodoc:
-    RESERVED_OPTIONS = [:anchor, :params, :only_path, :host, :protocol, :port, :trailing_slash, :skip_relative_url_root]
-
-    def initialize(request, parameters)
-      @request, @parameters = request, parameters
-    end
-
-    def rewrite(router, options = {})
-      options[:host]     ||= @request.host_with_port
-      options[:protocol] ||= @request.protocol
-
-      self.class.rewrite(router, options, @request.symbolized_path_parameters) do |options|
-        process_path_options(options)
-      end
-    end
-
-    def to_str
-      "#{@request.protocol}, #{@request.host_with_port}, #{@request.path}, #{@parameters[:controller]}, #{@parameters[:action]}, #{@request.parameters.inspect}"
-    end
-
-    alias_method :to_s, :to_str
-
-    # ROUTES TODO: Class method code smell
-    def self.rewrite(router, options, path_segments=nil)
-      handle_positional_args(options)
-
-      rewritten_url = ""
-
-      # ROUTES TODO: Fix the tests
-      segments = options.delete(:_path_segments)
-      path_segments = path_segments ? path_segments.merge(segments || {}) : segments
-
-      unless options[:only_path]
-        rewritten_url << (options[:protocol] || "http")
-        rewritten_url << "://" unless rewritten_url.match("://")
-        rewritten_url << rewrite_authentication(options)
-
-        raise "Missing host to link to! Please provide :host parameter or set default_url_options[:host]" unless options[:host]
-
-        rewritten_url << options[:host]
-        rewritten_url << ":#{options.delete(:port)}" if options.key?(:port)
-      end
-
-      path_options = options.except(*RESERVED_OPTIONS)
-      path_options = yield(path_options) if block_given?
-      path = router.generate(path_options, path_segments || {})
-
-      rewritten_url << ActionController::Base.relative_url_root.to_s unless options[:skip_relative_url_root]
-      rewritten_url << (options[:trailing_slash] ? path.sub(/\?|\z/) { "/" + $& } : path)
-      rewritten_url << "##{Rack::Utils.escape(options[:anchor].to_param.to_s)}" if options[:anchor]
-
-      rewritten_url
-    end
-
-  protected
-
-    def self.handle_positional_args(options)
-      return unless args = options.delete(:_positional_args)
-
-      keys = options.delete(:_positional_keys)
-      keys -= options.keys if args.size < keys.size - 1 # take format into account
-
-      args = args.zip(keys).inject({}) do |h, (v, k)|
-        h[k] = v
-        h
-      end
-
-      # Tell url_for to skip default_url_options
-      options.merge!(args)
-    end
-
-    def self.rewrite_authentication(options)
-      if options[:user] && options[:password]
-        "#{Rack::Utils.escape(options.delete(:user))}:#{Rack::Utils.escape(options.delete(:password))}@"
-      else
-        ""
-      end
-    end
-
-    # Given a Hash of options, generates a route
-    def process_path_options(options)
-      options = options.symbolize_keys
-      options.update(options[:params].symbolize_keys) if options[:params]
-
-      if (overwrite = options.delete(:overwrite_params))
-        options.update(@parameters.symbolize_keys)
-        options.update(overwrite.symbolize_keys)
-      end
-
-      options
-    end
-
-  end
-end