[1.5.x] Dropped fix_IE_for_vary/attach.

This is a security fix. Disclosure following shortly.
[1.5.x] Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.
Added release notes for 1.4.13, 1.5.8.
Bumped version numbers for release.
Bumped version number post release.