Security patch and other fixes

This was supposed to be just the security patch, but it ended up easier to
copy over most of the other fixes from my 2.5.x backports branch. Most of 
these are either: login related, or CSRF related.
They are all running in production on client sites.