Fixed PostGIS remove_field implementation

Fixed bad code introduced in 2f9d1576e8.
Fixed table cleanup in GIS migration tests
Fixed a remote code execution vulnerabilty in URL reversing.

Thanks Benjamin Bach for the report and initial patch.

This is a security fix; disclosure to follow shortly.
Prevented leaking the CSRF token through caching.

This is a security fix. Disclosure will follow shortly.
Fixed queries that may return unexpected results on MySQL due to typecasting.

This is a security fix; disclosure to follow shortly.
Added information on resolved security issues to release notes.
Fixed #22426 -- Added support old-style d.c.messages format.

Forward ported code from 1.5 that adds backwards compatibility with legacy message length.
See commit 9e7183073f64e541587e8dcfd8bb3ddeb47f8162 for details.

Thanks to Ofir Ovadia for the initial patch.
Added 1.6.4 release note stub.
Add a test case for __search lookup.