renamed plugins.protected.php to plugins.required.php and added it cascade to allow overwriting as a local protected file

This fixes password changing operations: password change and user
modification are two different operations on the AD backend - the user
modification should not be done on password only changes.

From the release notes: This release fixes a few bugs, including a major URL
parsing bug, where URLs with query strings were parsed incorrectly.

This makes the security token more robust agains session fixation
attacks. A CSRF warning will no longer abort a page save but lead to the
preview mode to avoid information loss when a user logs in during
editing (eg in another tab).

show accesskey also on actionlink title and add accesskey parameter only if a key is defined (FS#2226)

unset does not reset the Array's internal pointer which messes up later
calls. array_pop is still much faster than array_splice

Looks like a for loop is faster than array_splice

The file contained a few DOS lineendings and trailing spaces

Turned out a test wasn't really testing what it should have been testing
and thus did hide a bug. Still puzzles me why it still worked some
times.
This patch also sets the default iteration count for bmd5 and pmd5 to 8.