[1.4.x] Dropped fix_IE_for_vary/attach.

This is a security fix. Disclosure following shortly.
[1.4.x] Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.
Added release notes for 1.4.13.
Bumped version numbers for release.
Bumped version numbers post-release.
[1.4.x] Minor edits to latest release notes.

Backport of 860d31ac7a3bdd4b27db8b34b110b3d801ddaf8a from master
[1.4.x] Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

Backport of 0be4d64487 from master
[1.4.x] Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet.

Thanks sebastien at clarisys.fr for the report and gautier
for the patch.

Backport of 5e2c4a4bd1 from master
[1.4.x] Revert "Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet."

This reverts commit b44519072e8a0ef56a0ae9e6e4a1fb04273eb0eb.

stable/1.4.x branch is in security-fixes-only mode.
[1.4.x] Added tests/requirements/py2.txt.

This follows the convention used in other branches so we don't
need a special case in the build script for 1.4.
[1.4.x] Fixed #23149 -- Clarified note on HTTPOnly in cookie-based session docs

Backport of e26366da44bb343e7a95d01ff0dd18b8026c2802 from master.
[1.4.x] Fixed #23239 -- Clarified a phrase in the contrib.markup docs.

Backport of e0fb48c254 from stable/1.5.x
[1.4.x] Noted that django-jython requires Django 1.7.

Backport of 72e98d5c16 from stable/1.6.x
[1.4.x] Added a warning that remove_tags() output shouldn't be considered safe.

Backport of 7efce77de2 from master
[1.4.x] Added release note stub for 1.4.14.
[1.4.x] Prevented reverse() from generating URLs pointing to other hosts.

This is a security fix. Disclosure following shortly.
[1.4.x] Fixed #23157 -- Removed O(n) algorithm when uploading duplicate file names.

This is a security fix. Disclosure following shortly.
[1.4.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on REMOTE_USE change.

This is a security fix. Disclosure following shortly.
[1.4.x] Prevented data leakage in contrib.admin via query string manipulation.

This is a security fix. Disclosure following shortly.
[1.4.x] Bump version numbers for security release.