NEWS.rst: security improvements and other minor updates.

Signed-off-by: Daira Hopwood <david-sarah@jacaranda.org>