[1.4.x] Added ALLOWED_HOSTS setting for HTTP host header validation.

This is a security fix; disclosure and advisory coming shortly.
[1.4.x] Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.

This is a security fix. Disclosure and advisory coming shortly.
[1.4.x] Checked object permissions on admin history view.

This is a security fix. Disclosure and advisory coming shortly.

Patch by Russell Keith-Magee.
[1.4.x] Added a default limit to the maximum number of forms in a formset.

This is a security fix. Disclosure and advisory coming shortly.
[1.4.x] Update 1.4.4 release notes for all security fixes.
[1.4.x] Bump version numbers for security release.
[1.4.x] Don't characterize XML vulnerabilities as DoS-only.
[1.4.x] Fixed #19857 -- Fixed broken docs link in project template.
[1.4.x] Note that ALLOWED_HOSTS default changes in Django 1.5.
[1.4.x] Bump version numbers to roll a clean package.
[1.4.x] Made a couple of selenium tests wait for page loaded

The admin_widgets tests were issuing click() to the browser but
didn't wait for the effects of those clicks. This caused the resulting
request to be processed concurrently with the test case. When using
in-memory SQLite this caused weird failures.

Also added wait_page_loaded() to admin selenium tests for code
reuse.

Fixed #19856, cherry-pick of 50677b29af39ca670274fb45087415c883c78b04
[1.4.x] Fixed #19902 -- backport of as_view docs
[1.4.x] Fixed #19728 - Updated API stability doc to reflect current meaning of "stable".

Backport of 132d5822b0 from master.
[1.4.x] Fixed #19911 - Updated generic view links.

Thanks marc@ for the report.
[1.4.x] Fixed #18144 -- Restored compatibility with SHA1 hashes with empty salt.

Thanks dahool for the report and initial version of the patch.

Backport of 633d8de from master.