fixes #13828 - CVE-2016-2100 - only showing relevant bookmarks

(cherry picked from commit a61344da14f73920b4bdc7ad8220e7a0ed998031)

fixes #13852 - add user_data to images api docs

(cherry picked from commit 1cd4a22df2b4a34ea8a03150b1bd406494587ed3)

Fixes #12566 - host_parameters_attributes accepts nested flag

Fixes #12965 - provisioning/config templates are shown under OS API

(cherry picked from commit 3e4b2f7732fd7dd94cdd48bb75181b483c3e678b)

Fixes #12279 - add default order to roles

(cherry picked from commit a0218e662e5b7fad58334eda804dd1fa89b2fea1)

Fixes #11921 - load dynamic features during runtime

(cherry picked from commit 1d0315e0630f23ca6c794d456d076c00020df275)

Fixes #12201 - Made parent associations finder less dependent on association name

(cherry picked from commit 97b5cd0a27101907a333a84716489d73538812cc)

Fixes #12089 - fix using unwrapped parameters in config templates API controller

(cherry picked from commit 3b404bedba8758b0a5ed3426a8720199aa47d687)

Fixes #11237 - documenting hostgroup association to compute profile

(cherry picked from commit 9293c0fece525632c6d6242b9ee4a078cb77c419)

fixes #11996 - use preload to avoid multiple fact/host table joins

When retrieving fact_values as a non-admin user, the my_facts scope
performs a join to the hosts table. The .includes(:host) also performs
a join via eager loading, and when both are combined with a scoped...