[FIXED SECURITY-73] Require RUN_SCRIPTS for /heapDump.
[FIXED SECURITY-74] Apply markup formatter to remote cause note.
[FIXED SECURITY-75] Invalidate session after login to avoid session fixation
[FIXED SECURITY-76] Prevent iframe injection, forbid iframe by default
[FIXED SECURITY-77] XSS in iconSize cookie.
[FIXED SECURITY-79] Prevent (private security realm) usernames from being guessed.
[FIXED SECURITY-80] Add X-Frame-Options head to prevent clickjacking attacks
[FIXED SECURITY-88] Forbid offsite-bound forms in default markup formatter policy.
[FIXED SECURITY-89] When checking an API token, verify that the user actually exists.
[FIXED SECURITY-93] PasswordParameterDefinition should serve existing default value in encrypted form.
And strengthen functional tests (using configRoundTrip) to ensure that the same mistake is not made elsewhere.
[FIXED SECURITY-106] Jenkins on Winstone vulnerable to session hijacking.
[FIXED SECURITY-107] When security-related fields in Jenkins cannot be unmarshaled, it is best to halt startup.
[FIXED SECURITY-108] Check job name created via CLI
[FIXED SECURITY-109] SECURITY-55 fix to BuildTrigger configuration failed if downstream project was not visible.
[SECURITY-76] [SECURITY-88] Adjust test to policy changes.
Merge branch 'security' into security-rc

Conflicts:
	core/src/main/java/hudson/Functions.java
	core/src/main/java/hudson/markup/MyspacePolicy.java
	core/src/main/java/hudson/util/RobustReflectionConverter.java
	core/src/main/resources/lib/layout/layout.jelly
	war/pom.xml
[FIXED SECURITY-105] Disabling DynamicProxyConverter.
Merge branch 'security' into security-rc
[maven-release-plugin] prepare release jenkins-1.551
[maven-release-plugin] prepare for next development iteration