MFH: r443668 r443686

Security Update:

Add security patches from BestPractical. See

http://lists.bestpractical.com/pipermail/rt-announce/\
2017-June/000297.html

Security: 7a92e958-5207-11e7-8d7c-6805ca0b3d42

Revert patch-config.layout to r354074 -- 'make makepatch' wiped out
the %%PREFIX%% substitution token.

Pointyhat to me.

This, along with r443668 needs MFH to 2017Q2

Approved by: ports-secteam (zi)