Security patch and other fixes

This was supposed to be just the security patch, but it ended up easier to copy over most of the other fixes from my 2.5.x backports branch (http://github.com/rjmackay/Ushahidi_Web/tree/2.5.x). Most of these are either: login related, or CSRF related.
They are all running in production on client sites.