fixes #5471 html escape auto-completer values (CVE-2014-0208)

(cherry picked from commit ee672544f1ad5990ca0e39acd86f83cbbe06ebe9)

fixes #3914 - set current taxonomies on login from user defaults

Fixes #4851: a SmartProxy.with_features scope replaces feature-specific scopes generated during class loading

fixes #4776 - support session[:expires_at] for api requests

There are situations where the UI needs to invoke requests
on the API controllers; therefore, we need to ensure that
the session expiration accounts for them. This is a common
for plugins, such as Katello, which leverage the...

fixes #4457 - Session fixation, new session IDs are not generated on login (CVE-2014-0090)

fixes #4617 - add feature to change parent of location or organization

fixes #812 - new permissions model, user group role and nest support, role filters for better granularity

• Daniel Lobato <elobatocs@gmail.com>
• Joseph Magen <jmagen@redhat.com>
• Tom McKay <thomasmckay@redhat.com>
• Greg Sutcliffe <gsutclif@redhat.com>...

fixes #4393 - rename ancestry label to title

fixes #4423 - allow puppet classes to be imported by environment

fixes #3912 - add inheritance for locations / organizations