fixes #4456 - XSS on 500 error page and bookmark name causing render error (CVE-2014-0089)
fixes #4457 - Session fixation, new session IDs are not generated on login (CVE-2014-0090)