[1.3.x] Added ALLOWED_HOSTS setting for HTTP host header validation.

This is a security fix; disclosure and advisory coming shortly.
[1.3.x] Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.

This is a security fix. Disclosure and advisory coming shortly.
[1.3.x] Checked object permissions on admin history view.

This is a security fix. Disclosure and advisory coming shortly.

Patch by Russell Keith-Magee.
[1.3.x] Added a default limit to the maximum number of forms in a formset.

This is a security fix. Disclosure and advisory coming shortly.
[1.3.x] Update 1.3.6 release notes for all security fixes.
[1.3.x] Bump version numbers for security release.
[1.3.x] Don't characterize XML vulnerabilities as DoS-only.
[1.3.x] Fixed #19857 -- Fixed broken docs link in project template.

Backport of 4cdfb24c98 from 1.4.x.
sitemaps: add suport for other search engines
admin: add goto link for related models
contrib.auth: set max_length to 255, unique=True and blank=False for username and email
sitemaps: adjust get_urls to support new signature
contrib.auth: set max_length to 255 for user form
treat auth.user.username as email field
add django-cache-machine here until there is a sane way to attach django-cache-machine to 3rd party model
Revert "add django-cache-machine here until there is a sane way to attach django-cache-machine to 3rd party model"

Disable automatic model caching for now.

This reverts commit aea67b2ba616a38d5df0e70969bc85f9158ff375.
Allow aggregation results to be string values