[1.7.x] Removed an unnecessary anchor in the docs.

Backport of a06808d370 from master
[1.7.x] Dropped fix_IE_for_vary/attach.

This is a security fix. Disclosure following shortly.
[1.7.x] Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.
Added release notes for 1.4.13, 1.5.8, 1.6.5.
Bumped version number for release.
--skip-scripts is no longer a thing.

See https://bitbucket.org/pypa/wheel/commits/c29f82b4cf76df71f8d55b0f825af6063d3b9892.