#160107 by JohnAlbin: use the same session ID regardless of the protocol used to access the page (eg share sessions between http and https pages)

#134308 by dww. The DB API does not handle prefixes with '.' in them well; do not allow that at install time.

 #119196 by douggreen: apply file API common sense (permissions, file API functions instead of custom code) to files handled by color.module
 Backport from HEAD.

 Backport from HEAD.

#56357 by JohnAlbin, et al. Improve cookie naming to prevent conflicting cookies set on the same domain name.

#102252 by Darren Oh and Arancaytar. Override a previous rule which displays the contents of all tags, including script.

#123577 by tostinni and dvdweide. Show access denied instead of empty page for browsing hidden profile fields.