Shouldn't have been part of the previous commit since it didn't port the
rest of the panels support anyway.

(cherry picked from commit a910a743)

(cherry picked from commit 9472ffc3)

(cherry picked from commit c2258b5c)

(cherry picked from commit c0c29c34)

(cherry picked from commit 5bd794f4)

Thanks go to Eugene Ilyin:
http://drupal.org/node/1429208#comment-5561768.
(cherry picked from commit 673888f2)

Although not very likely that a user with permissions to set the
widget ID would abuse it for XSS attacks there is really no reason to
not protect it.