Merge branch 'security/entity_decode' into 3.1-stable