[1.3.x] Fixed a security issue in image uploading. Disclosure and release forthcoming.

Backport of dd16b17099b7d86f27773df048c5014cf439b282 from master.
[1.3.x] Fixed second security issue in image uploading. Disclosure and release forthcoming.

Backport of b1d463468694f2e91fde67221b7996e9c52a9720 from master.
[1.3.x] Fixed a security issue in http redirects. Disclosure and new release forthcoming.

Backport of 4129201c3e0fa057c198bdefcb34686a23b4a93c from master.
[1.3.x] Bump version numbers for security releases.
[1.3.x] Use correct download URL.
[1.3.x] Fixed #18692 -- Restored python 2.4 compatibility.

Thanks to chipx86 for the report.
[1.3.x] Bump version numbers for bugfix release.
Fixed a security issue related to password resets

Full disclosure and new release are forthcoming

backport from master
[1.3.x] Bump version numbers for security release.
Added missed poisoned host header test material
[1.3.X] Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.
[1.3.X] Fixed a security issue in get_host.

Full disclosure and new release forthcoming.
[1.3.x] Bump version numbers for security release.
[1.3.X] Fixed a test failure in the comment tests.

Backport of 1eb0da1c5ba3096f218d1df13d02a2b8e1ac7a36 from master.