Heine

- Patch #705306 by moshe weitzman: user_cancel_delete() method calls into a 'standard' user_delete_multiple() API.

- Patch #335035 by boombatower, Damien Tournoud, ksenzee, Berdir, Dave Reid, effulgentsia: Simpletest drupalPost() incorrectly submits input for disabled elements, causing unreliable testing of forms that contain them.

- Patch #681782 by Dave Reid: 'clean' option in token_replace() does not do anything.

- Patch #734762 by Damien Tournoud, sun, scor: tidy up the filter upgrade path.

- Patch #431776 by catch, agentrickard, Damien Tournoud, Dries: cron should run as anonymous when invoked via the run-cron link on the status report page.

#86299 follow-up by coltrane and clojel: Stop users' passwords from being stored in users.data in plain-text. Ouch.