fixed link in popup media manager to fullscreen media manager to open in correct namespace (FS#2401)

For some reason trailing/leading underscores were allowed when uploading
files. But the rest of the code (eg. listing or downloading files) never
supported this. This patch removes this special case for uploading files
to streamline ID cleaning of pages and media files.

On certain environments, stream_select might produce temporary errors
when file descriptors are running scarce.

renamed plugins.protected.php to plugins.required.php and added it cascade to allow overwriting as a local protected file

This fixes password changing operations: password change and user
modification are two different operations on the AD backend - the user
modification should not be done on password only changes.

From the release notes: This release fixes a few bugs, including a major URL
parsing bug, where URLs with query strings were parsed incorrectly.

This makes the security token more robust agains session fixation
attacks. A CSRF warning will no longer abort a page save but lead to the
preview mode to avoid information loss when a user logs in during
editing (eg in another tab).