fixes #5471 html escape auto-completer values (CVE-2014-0208)

(cherry picked from commit ee672544f1ad5990ca0e39acd86f83cbbe06ebe9)

fixes #4457 - Session fixation, new session IDs are not generated on login (CVE-2014-0090)

(cherry picked from commit cfa4b52638173b9cf77ee1a5fd0c3a273f875209)

Conflicts:
test/functional/users_controller_test.rb

fixes #3925 - create apipie param_groups for API v2 to DRY documentation

(cherry picked from commit 2be84f3d773e74b5cc37841284ec216996fd0b51)

fixes #3760 - API v2 define metadata @total for each controller

(cherry picked from commit 6f9438866488180e196ff18e1372cf0773afe7b9)

Conflicts:
foreman.spec

fixes #3515 - API handles not found objects with 404

(cherry picked from commit 46338cd73c542ecc3aa045b45e831434792c710e)

fixes #3658 - support smart proxy's chef proxy feature

fixes #3853 - allow rabl template override to be specified

3853-taxonomy-rabl - changed style of override

fixes #3930 - refactoring of edit_self implementation.

fixes #3280 - authenticate returns true for API requests when login:false

fixes #3018 - API v2 metadata for pagination, search, order in index collection json response