fixed xss in patient associated contacts.
fixed xss in family history comments.
fixed xss in preview operation
made gii only accessible from 127.0.0.1 by default.
fixed several sql injection bugs in EventTypeModuleCode
mitigated a data leak in EventTypeModuleCode.
fixed sql injection / privilege escalation bug in AuditController
fixed xss bug in BaseEventTypeElement
fixed xss bug in DropDownListNoPost widget.
fixed multiple xss bugs in widget views.
bugfix
Merge branch 'feature/security' into develop

Conflicts:
	protected/gii/EventTypeModule/EventTypeModuleCode.php
	protected/models/BaseEventTypeElement.php