- added intermediate SSL security profile (see https://mozilla.github.io/server-side-tls/ssl-config-generator/)
- TODO: admin option to choose between intermediate (default) and modern

Note: The mod_proxy_fcgi that ships with CentOS and Ubuntu does not support sockets yet, so all php-fpm connections are done by IP.

- changed hhvm handling to match stable branch (FilesMatch in Directory sections) - added changes from stable accordingly

Revert "Fixed: FS#3581 - Website unaccessible under some circumstances when using seo redirection *.domain to www.domain"

This reverts commit 5742e4c9.

Fixed: FS#3581 - Website unaccessible under some circumstances when using seo redirection *.domain to www.domain
(only for apache2, nginx still to do)

- Changed vhost.conf.master as php-fpm was not working after commit "5a6670bd".

- fixed vhost template. website settings were overriding handlers of apache config files, e. g. roundcube

- removed [PT] flags as it is causing problems with some php applications due to information in SCRIPT_NAME and PHP_SELF

@see http://httpd.apache.org/docs/2.2/en/mod/mod_actions.html#action

(nginx still missing)

 - Reason:
   AddHandler fcgid-script .php
   does not only parse .php files, but all .php.* (e. g. .php.txt, .php.test etc.)

Changed: apps vhost is now a template (for apache version)
Changed: template if tags can now be of format 'version' to make version comparisons (e.g. 2.12 > 2.2 !)
Changed: New apache 2.4 syntax for deny from all (-> Require all denied) etc.

- Fixed FS#2441 - FastCgiExternalServer: redefinition of previously defined class "/usr/lib/cgi-bin/php5-fcgi".

Fixed (partly) FS#2310 - Template switch not working in mailuser module, for dashlets and the login page

Merged revisions 3049-3051,3053-3054,3058,3070,3074-3077,3082,3086-3088,3091-3092,3094-3095 from stable branch.