[1.4.x] Fixed #21195 -- Clarifed usage of template_name in tutorial part 4.

Backport of b66a51ad545ac726ef98966cbc35ee7aefdff8cd from master.
[1.4.x] Clarified striptags documentation

The fact that striptags cannot guarantee to really strip all
non-safe HTML content was not clear enough. Also see:
https://www.djangoproject.com/weblog/2014/mar/22/strip-tags-advisory/

Partial backport (doc-only) of 6ca6c36f82 from master.
[1.4.x] Updated six to 1.6.1.

Backport of 2ec82c7387db071278201796208808de84c90dbf from master
[1.4.x] Fixed random aggregation_regress test_more_more_more() failure

The cause was assuming that an unordered queryset returns the values
always in the same order.

Backport of 33dd8f544205be923e2a06106909ebcd3583526b
[1.4.x] Corrected the section identifier for MySQL unicode reference.

Backport of b2514c02e1 from master
[1.4.x] Fixed a remote code execution vulnerabilty in URL reversing.

Thanks Benjamin Bach for the report and initial patch.

This is a security fix; disclosure to follow shortly.

Backport of 8b93b31487d6d3b0fcbbd0498991ea0db9088054 from master
[1.4.x] Prevented leaking the CSRF token through caching.

This is a security fix. Disclosure will follow shortly.

Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master
[1.4.x] Fixed queries that may return unexpected results on MySQL due to typecasting.

This is a security fix. Disclosure will follow shortly.

Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master
[1.4.x] Added information on resolved security issues to release notes.

Backport of c07f3e60c2d455e36ba4ac339d4283d32bbc3814 from master
[1.4.x] Bump version numbers for 1.4.11 security release.
[1.4.x] Post release version bump.
[1.4.x] Fixed #22486 -- Restored the ability to reverse views created using functools.partial.

Regression in 8b93b31.

Thanks rcoup for the report.

Backport of 3c06b2f2a3 from master
[1.4.x] Bump version numbers for 1.4.12 bugfix release.
[1.4.x] Post release version bump.
[1.4.x] Added dates to release notes of today's release.

Backport of 68d264059abb21b96c4fe68bf4d99520268a451c from master
[1.4.x] Dropped fix_IE_for_vary/attach.

This is a security fix. Disclosure following shortly.
[1.4.x] Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.
Added release notes for 1.4.13.
Bumped version numbers for release.
Bumped version numbers post-release.