Dropped fix_IE_for_vary/attach.

This is a security fix. Disclosure following shortly.
Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.
Added release notes for 1.4.13, 1.5.8, 1.6.5.
typo: urlaprse -> urlparse
Merge pull request #2653 from collinanderson/patch-1

typo: urlaprse -> urlparse
Fix typo that disabled code example highlighting
Merge pull request #2654 from merwok/patch-1

Fix typo that disabled code example highlighting