Some last minute fixes, that skipped release.

[maranda]

• Fix CVE-2018-10847, Metronome is also affected
• Fix BOSH not checking RID or WAIT attributes validity