Test allowedExtensions in UploadField, return correct HTTP status
BUG Prevent clickjacking in CMS and Security controllers (fixes #2215)
FIX preg_replace_callback in emailer was broken

Fixes bug introduced by 9deb11f9a0ee01477af38f2826b2a7583545a0b6
Email has no content
This is what happens when we make commits without testing!
Merge pull request #2229 from ss23/patch-6

FIX preg_replace_callback in emailer was broken
Merge pull request #2219 from chillu/pulls/clickjacking

BUG Prevent clickjacking in CMS and Security controllers (fixes #2215)
BUG First error should take precedence here. No further checks needed.
Merge pull request #2244 from mateusz/lockout-errors

BUG First error should take precedence here. No further checks needed.
FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692)
Merge pull request #2243 from hafriedlander/fix/flush_30

FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692)
Merge branch 'origin/3.0' into 3.1
FIX: Have ParameterConfirmationToken work regardless of include path
FIX: Ignore invalid tokens instead of throwing 403
Merge pull request #2248 from hafriedlander/fix/flush_30

FIX: Have ParameterConfirmationToken work regardless of include path
Merge branch 'origin/3.0' into 3.1
Versioned documentation typo (Thanks aragonne)
Updated comments to be more consistent on api.ss.org