fixes firefox build

includes fix to CVE-2015-1817

also remove ctl module option from default config
it is not loaded by default

ref #4002

CVE-2015-0291, CVE-2015-0290, CVE-2015-0207, CVE-2015-0286,
CVE-2015-0208, CVE-2015-0287, CVE-2015-0289, CVE-2015-0293,
CVE-2015-1787, CVE-2015-0285, CVE-2015-0209, CVE-2015-0288

ref #3976

ref #3979