Bug 12849 - fix URLs in sent lists

This brings back the http(s) to the URLs in sent lists.

Test plan:
* make a list
* send it to yourself
* see that the URLs aren't clickable
* apply the patch
* repeat, except now the URLs are better

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
By removing this bit of code, the code in Auth.pm is used
instead. The code there is not perfect, but the solution
works and both list and cart use the same code.

Passes tests and QA script.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 13425 - XSS in opac facets - Patch for 3.16

To Test
1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Test this one both in prog and bootstrap please

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Increment version for 3.16.5 release

Signed-off-by: Mason James <mtj@kohaaloha.com>
fix typo in release notes