Add unittest to check that session cookie set at logout is httponly
Escape add-on search string on "add to collection" (bug 780438)
prevent xss from UserProfile.display_name on admin deletion (bug 835827)
don't leak information on username/password when recaptcha is invalid on login page (bug 802771)
csrf protect delete_icon view in bandwagon (bug 967529)
Don't leak if email is known on password reset (bug 700599)
Merge branch 'httponly_session_cookie' of github.com:mozilla/olympia-security
Merge branch 'bug700599' of github.com:mozilla/olympia-security
Merge branch 'bug780438' of github.com:mozilla/olympia-security
Merge branch '835827-xss-deleting-account' of github.com:mozilla/olympia-security
Merge branch '802771-useless-recaptcha' of github.com:mozilla/olympia-security
Merge branch '967529-collection-icon-delete-csrf' of github.com:mozilla/olympia-security