Fixes #17195 - CVE-2016-8634 escape html in alert text

The alert helper used to mark the alert text as html_safe by default.
However, in some cases it may be possible for a user to enter custom
text into the alert message leading to a possible XSS vulnerability....

Fixes #16899 - rename helper with conflicting path name

Fixes #12193 - Stop using counter_cache for host[group] counts

This is aimed to prevent deadlocks caused by Rails' implementation of
counter_cache that is hit when multiple hosts are created or updated at
the same time. An added benefit is that the counters will now display...

Fixes #15629 - parameters form shows new parameters after error

refs #15336 - use i18n variable names and plural form

Fixes #15336 - Enables proper deletion of Orgs

Prior to this commit if you had an Org/Location with a host and tried to
the delete the Org. You would end up with an error that looks like

<Org> is used by <Host> (RuntimeError)

Basic error is these 2 areas...

Fixes #13164 - Add view_params permission

A new view_params permission was added for parameters inheriting from
Parameter object. The only exception is global parameters, which are
already handled by filter for CommonParameter resource.

This new permissions is also automatically added to viewer and site...

Fixes #15268 - limit user taxonomies using my scopes

Fixes CVE-2016-4475

Fixes #12945 - use helper for table css classes

Fixes #12979 - Create helper for "new" button

Previously the button classes were applied to new buttons using jQuery.
This commit creates a `new_link` helper that makes sure all new buttons
will receive the correct class and only display if authorized. Also a...