Merged r2697, r2720, r2723, r2724, r2727, r2745 from trunk.
Makes issues/show accept rss key (#3362).
Fixed: issue status bulk edit broken by r2726 (#3347).
Ability to use any custom field as a cross-project custom query column (#3321).
Do not autologin if more that one token is found (#3351).
Add token value uniqueness validation (#3351).
Use ActiveSupport::SecureRandom to generate tokens (#3351).
Fixed: issue bulk edit view broken by r2726 (#3347).
Fixed: issue move by non-admin broken by r2726 (#3354).
Escape custom field name.
