fixes #6402 - use standard success/error handlers in UI controllers

(cherry picked from commit b4fbdf574faf364fb1fc991c9363b3637ae70906)

fixes #5881 - XSS from create/update/destroy notification boxes (CVE-2014-3491)

(cherry picked from commit 983075c0c0e95c0d4715591325e88c90c7f09d71)

Fixes #5645: Fixes session undefined error when user has a default taxonomy set.

(cherry picked from commit e44762c830161a70235428cf175537fa9544377e)

fixes #5471 html escape auto-completer values (CVE-2014-0208)

(cherry picked from commit ee672544f1ad5990ca0e39acd86f83cbbe06ebe9)

fixes #3914 - set current taxonomies on login from user defaults

Fixes #4851: a SmartProxy.with_features scope replaces feature-specific scopes generated during class loading

fixes #4776 - support session[:expires_at] for api requests

There are situations where the UI needs to invoke requests
on the API controllers; therefore, we need to ensure that
the session expiration accounts for them. This is a common
for plugins, such as Katello, which leverage the...

fixes #4457 - Session fixation, new session IDs are not generated on login (CVE-2014-0090)

fixes #4617 - add feature to change parent of location or organization

fixes #812 - new permissions model, user group role and nest support, role filters for better granularity

• Daniel Lobato <elobatocs@gmail.com>
• Joseph Magen <jmagen@redhat.com>
• Tom McKay <thomasmckay@redhat.com>
• Greg Sutcliffe <gsutclif@redhat.com>...