Bug fixed B65-ZK-1897: Possible Cross-site Scripting Vulnerability 
http://tracker.zkoss.org/browse/ZK-1897
Bug Refixed B65-ZK-1889: zul.lang.wpd is always loaded twice with some
JS package merge configurations

http://tracker.zkoss.org/browse/ZK-1889
fine tune for security issue
Fix bug ZK-1896: ZK session timeout on JBoss AS 7 cluster issue
http://tracker.zkoss.org/browse/ZK-1896
B65-ZK-1900: Auto-complete Combobox in the bottom of the browser doesn't
sync dropdown position well http://tracker.zkoss.org/browse/ZK-1900
move sync popup position operations from ComboWidget.js to Combobox.js
minor fix sync combobox popup position
fix ZK-1891 Combobox with Validator will trigger reload selectedItem when typing,  test cases for 1891, 1895, 1899
Bug ZK-1895: Paging on listbox with onFulfill
Merge branch 'master' of github.com:zkoss/zk
Bug fixed B65-ZK-1904: Datebox doesn't sync dropdown stackup well (IE
only) http://tracker.zkoss.org/browse/ZK-1904
Merge branch 'master' of https://github.com/zkoss/zk into B65-ZK-1904
add comment for B65-ZK-1904
finetune testcase for 1895
fix ZK-1908: Databinding Load order causing problems on Paging component.
Bug fixed B65-ZK-1909: Set maxlength attribute to the doublebox
conponent, the maxlength checking is not correct
http://tracker.zkoss.org/browse/ZK-1909
Bug fixed B65-ZK-1913: AuResponse of stop comet server push would
override the request of start in some situation
http://tracker.zkoss.org/browse/ZK-1913
Bug ZK-1905: Chosenbox emptyMessage does not re-appear after remove all selected items
Merge branch 'master' of github.com:zkoss/zk
minor fix B65-ZK-1913.zul