Fixed the first argument to getsockopt().

While here, always initialize the last argument.
Upstream: keep $upstream_http_x_accel_redirect intact.

When processing the X-Accel-Redirect header, the value of the
$upstream_http_x_accel_redirect variable was also overwritten.
Detect more unsafe URIs in ngx_http_parse_unsafe_uri().

The following URIs were considered safe: "..", "../foo", and "/foo/..".
Teach ngx_http_parse_unsafe_uri() how to unescape URIs.

This fixes handling of escaped URIs in X-Accel-Redirect (ticket #316),
SSI (ticket #240), and DAV.
Dav: emit a warning about unsafe URI.
SPDY: fixed possible request hang.

Processing events from upstream connection can result in sending queued frames
from other streams.  In this case such streams were not added to handling queue
and properly handled.

A global per connection flag was replaced by a per stream flag that indicates
currently sending stream while all other streams can be added to handling
queue.
SPDY: refactored loop in ngx_http_spdy_body_filter().

No functional changes.
SPDY: a bit smarter ngx_http_spdy_filter_get_data_frame().

There is no need to pass FLAG_FIN as a separate argument since it can always be
detected from the last_buf flag of the last frame buffer.

No functional changes.
Style: removed surplus semicolons.
Fixed setting of content type in some cases.

This fixes content type set in stub_status and autoindex responses
to be usable in content type checks made by filter modules, such
as charset and sub filters.
Allowed up to two EBUSY errors from sendfile().

Fallback to synchronous sendfile() now only done on 3rd EBUSY without
any progress in a row.  Not falling back is believed to be better
in case of occasional EBUSY, though protection is still needed to
make sure there will be no infinite loop.
Added per-process random seeding (ticket #456).
Upstream: Cache-Control preferred over Expires.

Not really a strict check (as X-Accel-Expires might be ignored or
contain invalid value), but quite simple to implement and better
than what we have now.
Win32: support for UTF-16 surrogate pairs (ticket #457).
Fixed "zero size buf in output" alerts.

If a request had an empty request body (with Content-Length: 0), and there
were preread data available (e.g., due to a pipelined request in the buffer),
the "zero size buf in output" alert might be logged while proxying the
request to an upstream.

Similar alerts appeared with client_body_in_file_only if a request had an
empty request body.
SSL: ssl_session_tickets directive.

This adds support so it's possible to explicitly disable SSL Session
Tickets. In order to have good Forward Secrecy support either the
session ticket key has to be reloaded by using nginx' binary upgrade
process or using an external key file and reloading the configuration.
This directive adds another possibility to have good support by
disabling session tickets altogether.

If session tickets are enabled and the process lives for a long a time,
an attacker can grab the session ticket from the process and use that to
decrypt any traffic that occured during the entire lifetime of the
process.
SSL: fixed ssl_verify_depth to take only one argument.
Resolver: added support for domain names with a trailing dot.
Year 2014.
SPDY: fixed format specifiers in logging.