Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.

This is a security fix; disclosure to follow shortly.
Apply autoescaping to AdminURLFieldWidget.

This is a security fix; disclosure to follow shortly.
Added 1.4.6/1.5.2 release notes.