fix security issue CVE-2014-3704 with patch equiv. to Drupal Core 7.32 change; see https://www.drupal.org/SA-CORE-2014-005