Fixed a remote code execution vulnerabilty in URL reversing.

Thanks Benjamin Bach for the report and initial patch.

This is a security fix; disclosure to follow shortly.
Prevented leaking the CSRF token through caching.

This is a security fix. Disclosure will follow shortly.
Fixed queries that may return unexpected results on MySQL due to typecasting.

This is a security fix; disclosure to follow shortly.
Added information on resolved security issues to release notes.