Avoid PHP notices in wp-login.php if password reset cookie is not set.

props mdawaffe.
see #29060.
Built from https://develop.svn.wordpress.org/trunk@29381


git-svn-id: http://core.svn.wordpress.org/trunk@29159 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Constant time for wp_verify_nonce().

Built from https://develop.svn.wordpress.org/trunk@29382


git-svn-id: http://core.svn.wordpress.org/trunk@29160 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Media modal/grid: fix the position of attachment icons, restore the background, fix in ie8. See #27423.
Built from https://develop.svn.wordpress.org/trunk@29393


git-svn-id: http://core.svn.wordpress.org/trunk@29171 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Escape late in get_avatar().

Built from https://develop.svn.wordpress.org/trunk@29397


git-svn-id: http://core.svn.wordpress.org/trunk@29175 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Use proper non-capturing regex syntax for YouTube in `wp_video_shortcode()`.

Props Fab1en.
See [27063].
Fixes #29119.

Built from https://develop.svn.wordpress.org/trunk@29401


git-svn-id: http://core.svn.wordpress.org/trunk@29179 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Don't show the Featured Image metabox for users with the `contributor` role. Do enqueue media so that TinyMCE previews work for YouTube embeds, etc.

Props SergeyBiryukov.
Fixes #28327.

Built from https://develop.svn.wordpress.org/trunk@29402


git-svn-id: http://core.svn.wordpress.org/trunk@29180 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In `media.view.BulkSelectionActionButton.click()`, do not assume that `delete` is the only possible bulk action.

Fixes #29101.

Built from https://develop.svn.wordpress.org/trunk@29403


git-svn-id: http://core.svn.wordpress.org/trunk@29181 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Ignore entities in XML-RPC requests.

props mdawaffe, nacin.

Built from https://develop.svn.wordpress.org/trunk@29404


git-svn-id: http://core.svn.wordpress.org/trunk@29182 1a063a9b-81f0-0310-95a4-ce76da25c4cd
4.0-beta3

Built from https://develop.svn.wordpress.org/trunk@29414


git-svn-id: http://core.svn.wordpress.org/trunk@29192 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Media Grid: display upload errors in a dismissable sidebar.

See #29037.

Built from https://develop.svn.wordpress.org/trunk@29415


git-svn-id: http://core.svn.wordpress.org/trunk@29193 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Media Grid: after [28996], use the same cover size for audio/video files that images use for thumbnails.

See #24716.

Built from https://develop.svn.wordpress.org/trunk@29416


git-svn-id: http://core.svn.wordpress.org/trunk@29194 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Media Grid: expose the `$.Deffered()` object in `media.view.AttachmentsBrowser.updateContent()` so the grid can call `Backbone.history.start()` when models actually exist. 

This is a lot better then `_.delay( this.pray, 1000 )`, but needs continued study.

See #29052.

Built from https://develop.svn.wordpress.org/trunk@29420


git-svn-id: http://core.svn.wordpress.org/trunk@29198 1a063a9b-81f0-0310-95a4-ce76da25c4cd
After [29339] and [29341], add more unit tests and less ambiguous type-checking before bailing in meta-related functions that expect a numeric value for `$object_id`.

Props SergeyBiryukov.
Fixes #28315.

Built from https://develop.svn.wordpress.org/trunk@29421


git-svn-id: http://core.svn.wordpress.org/trunk@29199 1a063a9b-81f0-0310-95a4-ce76da25c4cd