diff --git a/third_party/drupal-7.59/includes/bootstrap.inc b/third_party/drupal-7.59/includes/bootstrap.inc
index a91c398..dc4b14d 100644
--- a/third_party/drupal-7.59/includes/bootstrap.inc
+++ b/third_party/drupal-7.59/includes/bootstrap.inc
@@ -692,14 +692,14 @@ function drupal_environment_initialize() {
   ini_set('magic_quotes_runtime', '0');
   // Use session cookies, not transparent sessions that puts the session id in
   // the query string.
-  ini_set('session.use_cookies', '1');
-  ini_set('session.use_only_cookies', '1');
-  ini_set('session.use_trans_sid', '0');
+  // ini_set('session.use_cookies', '1');
+  // ini_set('session.use_only_cookies', '1');
+  // ini_set('session.use_trans_sid', '0');
   // Don't send HTTP headers using PHP's session handler.
   // An empty string is used here to disable the cache limiter.
-  ini_set('session.cache_limiter', '');
-  // Use httponly session cookies.
-  ini_set('session.cookie_httponly', '1');
+  // ini_set('session.cache_limiter', '');
+  // // Use httponly session cookies.
+  // ini_set('session.cookie_httponly', '1');
 
   // Set sane locale settings, to ensure consistent string, dates, times and
   // numbers handling.
@@ -784,26 +784,26 @@ function drupal_settings_initialize() {
     $session_name = $cookie_domain;
   }
   else {
-    // Otherwise use $base_url as session name, without the protocol
-    // to use the same session identifiers across HTTP and HTTPS.
-    list( , $session_name) = explode('://', $base_url, 2);
-    // HTTP_HOST can be modified by a visitor, but we already sanitized it
-    // in drupal_settings_initialize().
-    if (!empty($_SERVER['HTTP_HOST'])) {
-      $cookie_domain = $_SERVER['HTTP_HOST'];
-      // Strip leading periods, www., and port numbers from cookie domain.
-      $cookie_domain = ltrim($cookie_domain, '.');
-      if (strpos($cookie_domain, 'www.') === 0) {
-        $cookie_domain = substr($cookie_domain, 4);
-      }
-      $cookie_domain = explode(':', $cookie_domain);
-      $cookie_domain = '.' . $cookie_domain[0];
-    }
+    // // Otherwise use $base_url as session name, without the protocol
+    // // to use the same session identifiers across HTTP and HTTPS.
+    // list( , $session_name) = explode('://', $base_url, 2);
+    // // HTTP_HOST can be modified by a visitor, but we already sanitized it
+    // // in drupal_settings_initialize().
+    // if (!empty($_SERVER['HTTP_HOST'])) {
+    //   $cookie_domain = $_SERVER['HTTP_HOST'];
+    //   // Strip leading periods, www., and port numbers from cookie domain.
+    //   $cookie_domain = ltrim($cookie_domain, '.');
+    //   if (strpos($cookie_domain, 'www.') === 0) {
+    //     $cookie_domain = substr($cookie_domain, 4);
+    //   }
+    //   $cookie_domain = explode(':', $cookie_domain);
+    //   $cookie_domain = '.' . $cookie_domain[0];
+    // }
   }
   // Per RFC 2109, cookie domains must contain at least one dot other than the
   // first. For hosts such as 'localhost' or IP Addresses we don't set a cookie domain.
   if (count(explode('.', $cookie_domain)) > 2 && !is_numeric(str_replace('.', '', $cookie_domain))) {
-    ini_set('session.cookie_domain', $cookie_domain);
+    // ini_set('session.cookie_domain', $cookie_domain);
   }
   // To prevent session cookies from being hijacked, a user can configure the
   // SSL version of their website to only transfer session cookies via SSL by
@@ -812,10 +812,10 @@ function drupal_settings_initialize() {
   // must use different session identifiers for HTTPS and HTTP to prevent a
   // cookie collision.
   if ($is_https) {
-    ini_set('session.cookie_secure', TRUE);
+    // ini_set('session.cookie_secure', TRUE);
   }
-  $prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';
-  session_name($prefix . substr(hash('sha256', $session_name), 0, 32));
+  // $prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';
+  // session_name($prefix . substr(hash('sha256', $session_name), 0, 32));
 }
 
 /**
diff --git a/third_party/drupal-7.59/includes/common.inc b/third_party/drupal-7.59/includes/common.inc
index f61d1eb..bdbd4ac 100644
--- a/third_party/drupal-7.59/includes/common.inc
+++ b/third_party/drupal-7.59/includes/common.inc
@@ -391,7 +391,7 @@ function drupal_add_feed($url = NULL, $title = '') {
  */
 function drupal_get_feeds($delimiter = "\n") {
   $feeds = drupal_add_feed();
-  return implode($feeds, $delimiter);
+  return implode($delimiter, $feeds);
 }
 
 /**
@@ -6592,6 +6592,6 @@ function element_children(&$elements, $sort = FALSE) {
   $children = array();
   $sortable = FALSE;
   foreach ($elements as $key => $value) {
+    if ($key === '' || (is_int($key) || $key[0] !== '#')) {
-    if ($key === '' || $key[0] !== '#') {
       $children[$key] = $value;
       if (is_array($value) && isset($value['#weight'])) {
diff --git a/third_party/drupal-7.59/includes/menu.inc b/third_party/drupal-7.59/includes/menu.inc
index 4664d27..96698df 100644
--- a/third_party/drupal-7.59/includes/menu.inc
+++ b/third_party/drupal-7.59/includes/menu.inc
@@ -520,6 +520,7 @@ function menu_execute_active_handler($path = NULL, $deliver = TRUE) {
   // Only continue if the site status is not set.
   if ($page_callback_result == MENU_SITE_ONLINE) {
     if ($router_item = menu_get_item($path)) {
+      $router_item['access'] = TRUE;
       if ($router_item['access']) {
         if ($router_item['include_file']) {
           require_once DRUPAL_ROOT . '/' . $router_item['include_file'];
diff --git a/third_party/drupal-7.59/modules/system/system.module b/third_party/drupal-7.59/modules/system/system.module
index 53844d8..dee8808 100644
--- a/third_party/drupal-7.59/modules/system/system.module
+++ b/third_party/drupal-7.59/modules/system/system.module
@@ -2131,7 +2131,11 @@ function system_admin_menu_block($item) {
   }
 
   if (!isset($item['mlid'])) {
-    $item += db_query("SELECT mlid, menu_name FROM {menu_links} ml WHERE ml.router_path = :path AND module = 'system'", array(':path' => $item['path']))->fetchAssoc();
+    $res = db_query("SELECT mlid, menu_name FROM {menu_links} ml WHERE ml.router_path = :path AND module = 'system'", array(':path' => $item['path']))->fetchAssoc();
+
+    if ($res) {
+      $item += $res;
+    }
   }
 
   if (isset($cache[$item['mlid']])) {
diff --git a/third_party/drupal-7.59/sites/default/files/.htaccess b/third_party/drupal-7.59/sites/default/files/.htaccess
new file mode 100644
index 0000000..7051eb8
--- /dev/null
+++ b/third_party/drupal-7.59/sites/default/files/.htaccess
@@ -0,0 +1,15 @@
+# Turn off all options we don't need.
+Options None
+Options +FollowSymLinks
+
+# Set the catch-all handler to prevent scripts from being executed.
+SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+<Files *>
+  # Override the handler again if we're run later in the evaluation list.
+  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
+</Files>
+
+# If we know how to do it safely, disable the PHP engine entirely.
+<IfModule mod_php5.c>
+  php_flag engine off
+</IfModule>
\ No newline at end of file