Image URLs are not properly escaped in the bundled RedCloth3 library.
It thus allowed an XSS vector.

The patch was adapted from r7570 from Redmine by Etiene Massip. See also
http://www.redmine.org/issues/9245.

Contributed by Toshi MARUYAMA

Also let the user know that the identifier must start with a lower case letter.

Contributed by Jan Schulz-Hofen.

[#652] fixes wrong redirect after login 

Conflicts:
	config/locales/nl.yml

even for sighted users

linked label where possible