Fixes #20963 - CVE-2017-7535 prevent XSS on org/loc host assign

Fixes #20951 - Replace render :text with :plain

fixes #20820 - set ajax vars for cr host import

Fixes #20386 - Allow to identify smart proxy by ip only

This allows setting trusted_puppet_master_hosts to an IP in the
non-https case. This can e.g. be useful when testing ansible fact
importing from another machine.

Fixes #19031 - move to patternfly pagination style

fixes #4509 - VMWare: multiple scsi controllers

Fixes #16112 - support for netgroups in LDAP auth source

fixes #19913 - fixes rubocop Style/ZeroLengthPredicate

Fixes #19315 - redirect to login when session expired

Refs #19588 - Allow passing header to csv responder