fixes #2630 - restrict assignment of roles to those a user has (CVE-2013-2113)
(cherry picked from commit bae665de387d63f93740670ec2542db90084d0eb)
fixes #2631 - fix remote code execution via controller name (CVE-2013-2121)
(cherry picked from commit ef4b97d177c58c9532730d53dca0517bc869a0ce)