Looks good ... thanks for driving this.
One comment about 
OF-705: the XSS vulnerabilities have actually been fixed (per the original request). The ticket remains open pending additional work to mitigate the remaining CSRF vulnerabilities.
Perhaps we can mark OF-705 as fixed (a significant improvement), and open another new ticket for 3.9.3 to track the pending CSRF work. What do you think?