CRM-15247 - CRM_Contact_Page_AJAX::getContactEmail - Validate inputs
CRM-15247 - CRM_Contact_Page_AJAX::checkUserName - Require a token before checking username

The use-case for this function: when a new constituent signs up for a user
account, we give advice on whether the username is available.

Unfortunately, attackers can use that functionality to scan the list of
usernames.  There's no protection from a motivated attacker (except to
disable new signups).

This patch aims to mitigate the problem in two ways:
 - For sites which don't allow user signups, the scanning won't work (b/c
   attackers can't obtain a token).
 - For sites which do allow signups, scanning requires more work
   (to obtain & refresh tokens).
CRM-15247 - CRM_Contact_Page_AJAX::autocomplete - Require a token
CRM-15248 - footer.tpl - For front-end users, redact point-release.

On one hand, giving a precise version can help attackers match their targets
with exploits.  On the other hand, giving some kind of version indication is
useful for support and marketing.  This PR attempts to balance the interests
by giving a precise version ("Powered by CiviCRM 4.4.6") to users with
permission "access CiviCRM" while giving a coarse-version ("Powered by
CiviCRM 4.4") to anyone else.