Network Settings: translate notification
network settings: add esc_url
General: Make sure that we can end up on the settings page after the plugin update right away
REST API: Update Plugin endpoint.

Capture the output in case something unpredicted gets there.
TESTS: REST API: Add Jetpack Endpoints test file.

+ Add a test for the update_plugin method.
Custom CSS: don't bother checking for a migrated CSS revision of the blog never had Custom CSS before it was migrated. Fixes #6046.

The issue reported was Sass wasn't compiling correctly in the front-end (saved revision). Turns out it was never stored properly because only "migrated" revisions store a "filtered" CSS string, which is where pre-processed CSS is stored.

See also #5957 -- although that will be a separate issue to solve.

Merges r101016-wpcom.
Custom CSS: trigger upgrade routine when Customizer loads, to support legacy blogs with old `safecss` options. Fixes #5957.

Merges r101018-wpcom.
Merge commit 'e7cbab3'
Infinite Scroll: check for valid `$post->post_date` object before returning a value in `get_last_post_date()`

A PHP notice occurs when a blog has no posts, like on this blog: [private link]

{{{
NOTICE: wp-content/mu-plugins/infinity/infinity.php:394 - Trying to get property of non-object
}}}

Merges r100619-wpcom.
Infinite Scroll: improve option text to explain why click-to-scroll is set by default in certain cases.

Fixes #4481.

See http://[private link].

Merges r100942-wpcom.
REST API: add CORS support for 404s

Add a Access-Control-Allow-Origin header for four oh four's. Comes with some tests to make sure that the header is only set in the right context

see https://[private link]

Merges r100757-wpcom.
Mitigate the Rosetta Flash JSON-P hole disclosed today.

http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

See http://[private link]

Merges r100803-wpcom.
REST API: Use the proper X- prefix on the X-Content-Options header.

Previously in r100803, we added the header to help mitigate the
Rosetta Flash JSON-P exploit, but neglected to use the X- prefix on
the header.

See http://[private link]

Merges r100804-wpcom.
REST API: fix a fatal error that occurred when trying to filter fields on an endpoint that returns an object (not wrapped in an array)

We now expliclity handle arrays and objects differently in the field fitering function.
Comes with a test to make sure the filter happens as expected.

Issue reported to us by a user in the developer support queue in #1877714-t

Merges r100835-wpcom.
REST API

Remove the nosniff header since it breaks IE9 - the /**/ fix should be enough.
We'll circle back on the header. See https://a8c.slack.com/archives/api/p1404945249000949 for some discussion

Merges r100926-wpcom.
REST API: refactor all endpoints code to remove 260kb files. Part 1

- This commit just copies the endpoints and adds the defines that will be used for hot swapping to the new code
- all tests are passing with or without the define
- probably will mess up some folks current work on their sandbox, sorry :(

Merges r100505-wpcom.
REST API: refactoring part 3; remove orig endpoints code

Merges r100511-wpcom.
Add new JSON endpoint files
Comment Likes: Enable comment likes when a new site is created

Merges r100526-wpcom.
Stats: Load stats px from cookie-less domain

We are going to use new cookie-less domains for both stats PX and JS files
to cut down on request sizes for these resources (large cookies are sent
for wordpress.com).

Step 7: Use `pixel.wp.com` domain for the rest of `wp-content/*`

See:
http://[private link]
http://[private link]

Merges r100912-wpcom.