Fix: Invalid arguments ($params format) for Session::setFlash()
Fix: Check for mcrypt availability and adjust default in settings.json

Closes #565
Remove hardcoded scheme to avoid mix content warning in SSL sites

Reported-by: tirins007
Fix: Avoid infinite loop caused by a broken theme manifest file
Merge remote-tracking branch 'upstream/master'