Custom CSS: don't bother checking for a migrated CSS revision of the blog never had Custom CSS before it was migrated. Fixes #6046.

The issue reported was Sass wasn't compiling correctly in the front-end (saved revision). Turns out it was never stored properly because only "migrated" revisions store a "filtered" CSS string, which is where pre-processed CSS is stored.

See also #5957 -- although that will be a separate issue to solve.

Merges r101016-wpcom.
Custom CSS: trigger upgrade routine when Customizer loads, to support legacy blogs with old `safecss` options. Fixes #5957.

Merges r101018-wpcom.
Merge commit 'e7cbab3'
Infinite Scroll: check for valid `$post->post_date` object before returning a value in `get_last_post_date()`

A PHP notice occurs when a blog has no posts, like on this blog: [private link]

{{{
NOTICE: wp-content/mu-plugins/infinity/infinity.php:394 - Trying to get property of non-object
}}}

Merges r100619-wpcom.
Infinite Scroll: improve option text to explain why click-to-scroll is set by default in certain cases.

Fixes #4481.

See http://[private link].

Merges r100942-wpcom.
REST API: add CORS support for 404s

Add a Access-Control-Allow-Origin header for four oh four's. Comes with some tests to make sure that the header is only set in the right context

see https://[private link]

Merges r100757-wpcom.
Mitigate the Rosetta Flash JSON-P hole disclosed today.

http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

See http://[private link]

Merges r100803-wpcom.
REST API: Use the proper X- prefix on the X-Content-Options header.

Previously in r100803, we added the header to help mitigate the
Rosetta Flash JSON-P exploit, but neglected to use the X- prefix on
the header.

See http://[private link]

Merges r100804-wpcom.
REST API: fix a fatal error that occurred when trying to filter fields on an endpoint that returns an object (not wrapped in an array)

We now expliclity handle arrays and objects differently in the field fitering function.
Comes with a test to make sure the filter happens as expected.

Issue reported to us by a user in the developer support queue in #1877714-t

Merges r100835-wpcom.
REST API

Remove the nosniff header since it breaks IE9 - the /**/ fix should be enough.
We'll circle back on the header. See https://a8c.slack.com/archives/api/p1404945249000949 for some discussion

Merges r100926-wpcom.
REST API: refactor all endpoints code to remove 260kb files. Part 1

- This commit just copies the endpoints and adds the defines that will be used for hot swapping to the new code
- all tests are passing with or without the define
- probably will mess up some folks current work on their sandbox, sorry :(

Merges r100505-wpcom.
REST API: refactoring part 3; remove orig endpoints code

Merges r100511-wpcom.
Add new JSON endpoint files
Comment Likes: Enable comment likes when a new site is created

Merges r100526-wpcom.
Stats: Load stats px from cookie-less domain

We are going to use new cookie-less domains for both stats PX and JS files
to cut down on request sizes for these resources (large cookies are sent
for wordpress.com).

Step 7: Use `pixel.wp.com` domain for the rest of `wp-content/*`

See:
http://[private link]
http://[private link]

Merges r100912-wpcom.
Merge commit '939a161'
Post Flair: Improve Custom Icon URL sanitation.

http://[private link]

https://hackerone.com/reports/18635

Merges r100615-wpcom.
Post Flair: Improve Custom Icon URL sanitation take 2.

1. The loop was bad (grrr)
2. The `esc_url_raw( wp_specialchars_decode() )` transformation needs to be applied in full for each iteration since `esc_url_raw()` strips characters.

http://[private link]

https://hackerone.com/reports/18635

Merges r100621-wpcom.
Merge commit '6adf1d7'
Post Flair/Sharing buttons: don't set the sharing label to the default one if it's set to an empty string, otherwise the UX of saving an empty one on purpose is very confusing

see https://[private link]

Merges r100941-wpcom.