Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.

This is a security fix; disclosure to follow shortly.
Apply autoescaping to AdminURLFieldWidget.

This is a security fix; disclosure to follow shortly.
Bumped version numbers for 1.5.2.
Added 1.4.6/1.5.2 release notes.