#346285 by grendzy, Damien Tournoud, thekevinday et al: fixed problem when HTTP_HOST is not transmitted

- Patch #335385 by Dave Reid: fixed maxlength of path alias fields to be consistent with the database.

#323386 by mariuss: The selection type in profile module expects items each on their own line and should not break items on commas

#103528 by gpk, hass & salvis. Provide a useful message when the color picker is disabled due to the download method.

#299582 by hass: Remove outdated items from robots.txt and fix ordering of items to make stuff easier to find.

#28776 by Uwe Hermann, Morbus Iff, jvandyk: Protect *.test files and SVN metafiles from being exposed under Drupal

#324875 by pwolanin: improve HTTP_HOST checking, ensuring that the host is lowercased and only valid characters are allowed.

#280934 follow up by pwolanin: harden the cookie handling in sess_regenerate() by setting our session cookie to be an HTTP only cookie, thus reducing the risk of session stealing via XSS

#195161 by mcarbone with some modifications: only show 'login to post comments' if logging in actually lets you post comments. Backport by salvis.

Last commit was actually: #213699 reported by gpk, patch by c960657: Race condition in sess_write() caused duplicate entry errors in the sessions table, fix that.

#293612 by egfrith, Bart Jansens: let user_authenticate() be called without cookies previously set; allows web service modules to start a session with the authentication.

#312730 by Damien Tournoud. hook_requirements('install') should work for modules that don't reside in the main './modules' folder.

#67895 patch by goba, tested by JirkaRybka and blackdog: move poll votes with poll options, when an option is removed, instead of dropping all old votes, solving an old data loss bug. Backport by dww.

#208270 reported by Dries, patch by jvandyk: it was not possible to clear the XML-RPC error cache, making it impossible to do multiple queries in one request. Add xmlrpc_clear_error() and slightly modify xmlrpc_error() to fix.

follow up to #280621 by lilou: the object tag was disallowed in a previous version in filter_xss_admin(), so disallow param as well, which is only meaningful inside an object tag

- Patch #230932 by ryanlath: file_scan_directory() didn't scan the directory called '0'. Backport by cridenour.