#150851 by pwolanin and chx: different radio buttons in the same set should have different HTML id values (XHTML validity fix). Backport #367689 by gollyg.

#346285 by grendzy, Damien Tournoud, thekevinday et al: fixed problem when HTTP_HOST is not transmitted

#324875 by pwolanin: improve HTTP_HOST checking, ensuring that the host is lowercased and only valid characters are allowed.

#280934 follow up by pwolanin: harden the cookie handling in sess_regenerate() by setting our session cookie to be an HTTP only cookie, thus reducing the risk of session stealing via XSS

Last commit was actually: #213699 reported by gpk, patch by c960657: Race condition in sess_write() caused duplicate entry errors in the sessions table, fix that.

#293612 by egfrith, Bart Jansens: let user_authenticate() be called without cookies previously set; allows web service modules to start a session with the authentication.

#312730 by Damien Tournoud. hook_requirements('install') should work for modules that don't reside in the main './modules' folder.

#208270 reported by Dries, patch by jvandyk: it was not possible to clear the XML-RPC error cache, making it impossible to do multiple queries in one request. Add xmlrpc_clear_error() and slightly modify xmlrpc_error() to fix.

- Patch #230932 by ryanlath: file_scan_directory() didn't scan the directory called '0'. Backport by cridenour.

- Patch #246143 by bjaspan, Damien Tournoud: make sure updates are run in numeric order, not in definition order.

#117748 by webchick, Pancho, Rob Loach, pwolanin: required field values were not properly trim()ed on validation

#128846 by takashi, chx, bdragon, wedge, salvis, Shiny: rewritten queries on PostreSQL need to have matching DISTINCT ON and ORDER BY expressions

- Patch #258128 by webchick: @parameter should be @param.  Gets the Most Trivial Patch of the Month Award.
Backport by gpk.

- Patch #191116 by david: make drupal_urlencode() rfc 1738 compliant to make it work correctly with spaces.

- Patch #231132 by snufkin: fixed invalid XML-RPC error messages due to HTML tags being inserted in the message string.

Backport in #109459.