Fix token upgrade error

If a user is already logged in and visits a page, then it may create a
token using the json encoding.  Then user goes to upgrade the php
unserialize() fails.  Now we check in case of php unserialize()
failure that the token isn't a valid json token before erroring out.

Fixes #17806
Go to install after login if db upgrade required

If admin checks are enabled and database upgrade is required then
redirect to install page instead of the return or default pages.
This will help direct the user towards upgrading rather than
visiting normal pages and getting php errors.

Fixes #17806
Display custom fields possible values separator

It is currently hard for users to guess the separator to use for the
custom fields possible values.  Add a localized string to display
next to the field on the form

Fixes #17825
Increase size of custom field possible valus field
Revise string for 'separate lists by'
Merge pull request #533 from vboctor/Issue17825_custom_field_separator

Clarify separator that can be used to separate possible values

Fixes #17825
Merge pull request #532 from vboctor/Issue17806_UpgradeError

Fixes #17806: Upgrade your installation consistently failing

The admin checks were mostly moved as is to the top of the page to use them to set a hidden field on the form. However, the warnings are displayed at the same location as before.
Relationship emails disclose related issue

This fix tackles the following scenarios:

- Users no longer get notified about relationships that they don't have access to.
- Users no longer see relationships listed in email notifications that they don't have access to.
- Users no longer see history events associated with relationships they don't have access to.
- Emails are constructed within the context of the target user not the logged in one.

Fixes #9885
Align filter links with filter buttons

Fixes #17814
Changing columns for single projects

- Simply manage columns access checks/form paramters
- Set user id to NO USER when in Manage - Manage Columns and Logged in User when in My Account - Manage Columns.
- Allow user to set columns for all / current project based on active project.

Fixes #13699
Collapse filter box by default

The filter box takes a large vertical space and it is expanded by default.
This change makes it collapsed by default.

Fixes #17830
XML plugin: Add config page with access thresholds

Prior to this, any user of a MantisBT instance with the XML
Import/Export plugin enabled and knowing the URL to the plugin's import
page could upload an XML file and insert data without restriction,
regardless of their access level.

This vulnerability is particularly dangerous when used in combination
with the one described in issue #17725 (CVE-2014-7146) as it makes for a
very simple and easily accessible vector for PHP code injection attacks.

There was also no access check when exporting data, which could allow an
attacker to gain access to confidential information (disclosure of all
bug-related data, including usernames).

Fixes #17780 (CVE-2014-8598)
XML import plugin does not process links

There was an error in the if statement logic in ImportXML::import(), due
to an incorrectly placed closing parenthesis, the replace statement was
never executed.

Fixes #17774
XML import plugin: replace links in 'steps to reproduce'

Duplicates logic used to process links for 'description' field.

Fixes #17775
Remove useless 'e' modifier in bug link regex
XML Import: use new method to replace bug links

A new private method replaceLinks() was added to avoid code duplication.
Now replacement of buglinks for 'description', 'steps_to_reproduce' and
'additional_information' is performed via this method.
New BugData object due_date should be blank

Prior to this, the due_date field was initialized to 0, causing the date
to be incorrectly preset to 1970-01-01 00:00 UTC.

Fixes #17847
XML Import: HTML/CSS fixes
Whitespace
XML Import/Export plugin fixes

Pull Request #539