#86299 by pwolanin, neochief, fwalch, thePanz, et al: Security hardening: Add 'current password' field to 'change password form'.

- Patch #607238 by agentrickard: fixed user_modules_uninstalled() calling hook_permission() for already uninstalled modules.

- Patch #660302 by reglogge, samhassell, agentrickard, jhodgdon: registration e-mails should not contain passwords.

- Patch #46149 by Senpai, sun, alexanderpas, hunmonk, ChrisKennedy, tstoeckler, cwgordon7: prevent account cancellation for uid 1.

- Patch #590656 by pwolanin, Pasqualle: harden one-time login links against vulnerability from disclosure of SQL backups, or SQL 'SELECT' injection.

- Patch #638070 by carlos8f, Gábor Hojtsy, ksenzee, pwolanin, chx, catch: router loaders causing a lot of database hits for access checks.

#525622 by Frando, yched, et al: Add entity hook callbacks so that 'as link' formatters have a generic way to build the url of an 'entity'.

#636992 by catch, yched: Fixed Entity loading needs protection from infinite recursion. Prevents unnecessary user_load()s from RDF.

#620616 by Bojhan, reglogge, lisarex, jhodgdon, and yoroy: Fix inconsistencies in menu description labeling.

#679890 follow-up by Bojhan, aspilicious, and agentrickard: Remove more extraneous 'Please' in the interface.

- Patch #601548 by Damien Tournoud, moshe weitzman: loosen the dependency between t() and the theming layer.

- Patch #635378 by sun, sivaji, carlos8f: wrong local task titles for taxonomy term and user account pages.

#633616 by batigolix, lisarex, arianek, samirnassar, tobiasb, and jhodgdon: Update user module to new help standard.

- Patch #502190 by jhodgdon, stella, sun: hook implementation headers out of compliance with standards.

- Patch #645374 by sun: make object IDs available to form submit handlers. This should be a best practice, IMO.

#619666 by effulgentsia, casey, and catch: Changed Introduce new pattern for drupal_static() in performance-critical functions.

- Patch #530652 by sun: _user_password_dynamic_validation() should be a #process of password_confirm().