Comment 14 for bug 1902965

I've pushed to security/user/gmcharlt/lp1902965 a signoff of Jeff's latest along with a follow-up fixing an issue that it revealed in the accordianization of notes.

At this moment, I believe that the branches to base release-cutting:

3.7-beta: user/gmcharlt/lp1902965 (or more strictly speaking, cherry-picks from that)
3.4: security/collab/dyrcona/lp1902965_marc_xss-rel_3_4
3.5: security/collab/dyrcona/lp1902965_marc_xss-rel_3_5
3.6: security/collab/dyrcona/lp1902965_marc_xss-rel_3_6