Fixed a security issue related to password resets

Full disclosure and new release are forthcoming

backport from master
[1.3.x] Bump version numbers for security release.
Added missed poisoned host header test material
[1.3.X] Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.
[1.3.X] Fixed a security issue in get_host.

Full disclosure and new release forthcoming.
[1.3.x] Bump version numbers for security release.
[1.3.X] Fixed a test failure in the comment tests.

Backport of 1eb0da1c5ba3096f218d1df13d02a2b8e1ac7a36 from master.
[1.3.x] Added ALLOWED_HOSTS setting for HTTP host header validation.

This is a security fix; disclosure and advisory coming shortly.
[1.3.x] Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.

This is a security fix. Disclosure and advisory coming shortly.
[1.3.x] Checked object permissions on admin history view.

This is a security fix. Disclosure and advisory coming shortly.

Patch by Russell Keith-Magee.
[1.3.x] Added a default limit to the maximum number of forms in a formset.

This is a security fix. Disclosure and advisory coming shortly.
[1.3.x] Update 1.3.6 release notes for all security fixes.
[1.3.x] Bump version numbers for security release.
[1.3.x] Don't characterize XML vulnerabilities as DoS-only.
[1.3.x] Fixed #19857 -- Fixed broken docs link in project template.

Backport of 4cdfb24c98 from 1.4.x.
[1.4.x] Note that ALLOWED_HOSTS default changes in Django 1.5.
[1.3.x] Bump version numbers to roll a clean package.