#462428 by Heine, pwolanin, and dww: SA-CORE-2009-006 - Drupal core - Cross site scripting forward-port.

- Patch #464912 by pwolanin: add doxygen suggestion standard for contrib module node build modes and similar int constants.

- Patch #407294 by Litrik: provide hooks to allow other modules to listen to SimpleTest results.  Java-lamp, here I come!

- Patch #293511 by cwgordon7, catch, dereine, Wisif, ThiOz: added a test for menu_get_item() and menu_set_item().

#464878 by chx: Fix SQLite abstraction layer to accept arrays of placeholder values without leading :, for compatibility with PDO.

#455576 by Xano and sirkitree: Revamp user settings page with vertical tabs, better organization, etc. Awesomeness.

#454992 by sun and bengtam: Remove 'q' from the possible letters that can be appended to an aggregated css/js string, so it's not confused with ['q'].

#452704 by andypost: Prefix aggregated CSS and JS files to prevent certain firewalls from blocking them if by random coincidence they start with ad*.

#196862 by Damien Tournoud, et al: Replace COUNT(*) queries with SELECT 1 ... LIMIT 1 queries when all that's required is a check for whether rows exist.

#292565 follow-up by Jody Lynn: Remove ['destination'] hacks to get login redirection working again.