Issue #161: Backport security fixes from Drupal 7.26, SA-CORE-2014-001.

PR for https://github.com/backdrop/backdrop-issues/issues/161, this solves the only remaining security issue from that thread, which is a FAPI enhancement, not really a security fix in itself.