Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.

This is a security fix; disclosure to follow shortly.
Bumped version numbers for 1.4.6.
Added 1.4.6/1.5.2 release notes.
Stole the Makefile for building packages from master.