Don't allow CMS to be displayed in an iframe for security reasons.
Instruct compliant browsers not to display CMS pages in frames
Merge branch 'master' into security
Use SAMEORIGIN instead of DENY since the CMS sometimes uses local frames.
Require current password in order to change password.
Use JspUtils.isSecureRequest method.
Add ability to set default role for new user accounts.
Merge branch 'master' into security

Conflicts:
	db/src/main/java/com/psddev/cms/tool/ToolFilter.java
Re-labeling of current password field, per Steve Rice
Merge branch 'master' into security
Remove the "none" option.
Merge branch 'release/2.0' into security
Removes the frame escape since this is too dangerous to apply generally for now.
Moves default role to be set from CmsTool instead of being embedded in ToolRole.
Formatting + wording.
Changes password field to only ask for your current password if not new user.