Ignore derived.
Prevent zlib-based DoS when parsing the cookie containing paste tokens.

Fixes LP #1094049.
Add permissions to some unprotected methods of 'OFS.ObjectManager'

Fixes LP #1094221.
Prevent arbitrary redirections via faked "CANCEL" buttons.

Fixes LP #1094144.
Prevent sandbox escape via 'BaseRequest.traverseName'.

Fixes LP #1095343.