174940 by gpk: avoid calling up the full Drupal bootstrap for nonexistent favicon.ico. Backport by matt@antinomia.

#150851 by pwolanin and chx: different radio buttons in the same set should have different HTML id values (XHTML validity fix). Backport #367689 by gollyg.

#62926 by karschsp: increase the free tagging field maximum length to 1024; the database limits are per-tag.

#346285 by grendzy, Damien Tournoud, thekevinday et al: fixed problem when HTTP_HOST is not transmitted

- Patch #335385 by Dave Reid: fixed maxlength of path alias fields to be consistent with the database.

#323386 by mariuss: The selection type in profile module expects items each on their own line and should not break items on commas

#103528 by gpk, hass & salvis. Provide a useful message when the color picker is disabled due to the download method.

#299582 by hass: Remove outdated items from robots.txt and fix ordering of items to make stuff easier to find.

#28776 by Uwe Hermann, Morbus Iff, jvandyk: Protect *.test files and SVN metafiles from being exposed under Drupal

#324875 by pwolanin: improve HTTP_HOST checking, ensuring that the host is lowercased and only valid characters are allowed.

#280934 follow up by pwolanin: harden the cookie handling in sess_regenerate() by setting our session cookie to be an HTTP only cookie, thus reducing the risk of session stealing via XSS

#195161 by mcarbone with some modifications: only show 'login to post comments' if logging in actually lets you post comments. Backport by salvis.

Last commit was actually: #213699 reported by gpk, patch by c960657: Race condition in sess_write() caused duplicate entry errors in the sessions table, fix that.

#293612 by egfrith, Bart Jansens: let user_authenticate() be called without cookies previously set; allows web service modules to start a session with the authentication.