Merge branch 'release/0.5'
Updating the version
Fixing the version number
Moving to version 0.6
Replace use of mysql_error()

Note I didn't touch the portion of install that actually sets up the
database, since that section is all mysql-specific.
template: remove unjustified, buggy header overrides for ajax

The Content-Type here desperately needs to set the character encoding
(UTF-8).  But there's no reason to override the default Content-Type
anyway.

Similarly for caching; boo hoo users can't use F5, that's what AJAX means.
(The only one we have at the moment is POST, so it won't be cacheable
anyway).
e(): switch to htmlspecialchars()

Mentioned to @seandowney as an aside in private mail, when I first started
looking at XSS.

htmlentities() is used in cases where you're not sure about character
encoding, so you want to coerce the output to ASCII and use character
references to represent any non-ASCII characters.

However Bonfire sensibly marks all output as UTF-8.  So we can avoid
generating ugly character references (and any overhead that causes) for
non-ASCII strings.
created protected method to retrieve db error message

Considering just checking $this->db->platform() and calling the
appropriate function rather than calling $this->db->_error_message()
add get_db_error_message to install model
use platform to determine action, fallback on _error_message
permission matrix: add a quick error handler for evil silent errors

"In general, I get the impression we didn't want _A_JAX;
we wanted to use a fake-synchronous XHR technique
(real synchronous XHR can have the disadvantage of hanging
the entire browser)."

But for now, here's a quick solution for some outstanding concerns.
themes: add jquery.cookie, v1.2-8-g107eb9f (currently unmerged!)

I.e. current master + https://github.com/carhartl/jquery-cookie/pull/104

A cookie function is the easiest way to get the CSRF token for AJAX
requests.  We'd like to use the jquery cookie plugin (other people have
recommended it for this exact usage).  Include it in the default theme
as well as the admin theme, for sites which use AJAX in their front end.

Unfortunately the jquery cookie plugin was reported as failing randomly in
IE.  We don't want random failures.  Especially as lots of AJAX code, like
Bonfire 0.5, doesn't bother with error handling so the failures would be
silent as well as random.  This is why we need the pull request mentioned
above.
permission matrix: was broken by CSRF protection - fix #596
Un-break login redirect

Pull request #570 didn't fix login redirects; it just broke them in a
deceptively consistent manner.

 1. $ignore_pages still contained 'login',
    but the routed string is '/users/login'.

 2. Since login page was not being ignored,
    it would always become the requested page.

 3. When the login page redirected to itself,
    it would detect that the user was now logged in,
    and redirect to '/'.  Ignoring both
    the requested page logic and the
    per-role default redirect.

Fix the $ignore_pages list to contain routed urls.

Also fix the other user of $ignore_pages to check the routed url.

I don't _think_ there's anything wrong with the general principle,
using the routed url as a "more canonical" value.
Also fix the other user of $ignore_pages to check the routed url

(was supposed to be included in previous commit)
Move to version 0.6.1
Update changelog
Merge branch 'hotfix' (proposed as v0.6.1) into develop

Conflicts (version numbers only):
	bonfire/application/config/constants.php
	install/config/constants.php
Revert "install: fix warning from html5 validator (unnecessary ".." in url)."

(It wasn't quite as unnecessary as I thought.  So we need a different solution).

This reverts commit 683f97564d199dd5e091a6c21d88b97d82868825.
install: could be in a subdirectory ending with "install"

so don't do a global removal of "install/".  We only want to remove the
"install/" at the end of the URL.