Drupal 8.0.4, SA-CORE-2016-001 by Alan Evans, benjy, berdir, catch, DamienMcKenna, Dave Reid, David_Rothstein, dsnopek, FengWen, fnqgpc, greggles, Gábor Hojtsy, klausi, larowlan, Pere Orga, plach, pwolanin, quicksketch, stefan.r, StryKaizer, YesCT

(cherry picked from commit f25feddd)

Conflicts:
	core/lib/Drupal.php

Issue #2512452 by dawehner, pwolanin, alexpott, fnqgpc: Confirm form cancel button can lead to external domain

Revert "Issue #2512452 by dawehner, pwolanin, fnqgpc: Confirm form cancel button can lead to external domain"

This reverts commit 1462460f.

Issue #2512452 by dawehner, pwolanin, fnqgpc: Confirm form cancel button can lead to external domain