fix jsonp rosetta flash vulnerability, see http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
Make ./var/log when needed so that it isn't in git

Then we can have puppet create a symlink without dirtying the working dir.
Merge branch 'master' into Login_via_OpenID