Issue #3156880 by alexpott, Gábor Hojtsy, andypost, hussainweb: \Drupal\Core\Access\CsrfTokenGenerator::validate() - ensure $token is a string before calling hash_equals()

Issue #3053956 by alexpott, neeravbm, aleevas, voleger, Berdir: Deprecate \Drupal\Component\Utility\Crypt::hashEquals() in favour of PHP's builtin hash_equals()

Issue #3004281 by kiamlaluno, dhirendra.mishra, hardikpandya, borisson_: The description of the return value makes reference to a setting that doesn't exist anymore

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

Issue #2478119 by znerol, andypost: Replace references to Session Manager with references to Session

Issue #2256257 by znerol, cosmicdreams | YesCT: Move token seed in SessionManager in isSessionObsolete() and regenerate()  to the MetadataBag.

Issue #2245003 by znerol, YesCT, sun, damiankloip: Use a random seed instead of the session_id for CSRF token generation.

Issue #2245117 by znerol: Remove the optional $skip_anonymous parameter from CsrfTokenGenerator::validate and remove the dependency on current_user service.

Issue #2228341 by sun, znerol, skipyT, ParisLiakos: Objectify session management functions + remove session.inc.

Revert "Issue #2201919 by damiankloip: Replace drupal_get_hash_salt() with direct Settings call in CsrfTokenGenerator."

This reverts commit aad87a80.

Issue #2201919 by damiankloip: Replace drupal_get_hash_salt() with direct Settings call in CsrfTokenGenerator.

Issue #2188289 by Jaypan, sun, jibran, Berdir: fix up docs for token functions and methods in regards to anonymous users and sessions

Issue #2141041 by Heine, klausi, David_Rothstein, amateescu, tim.plunkett, : CsrfTokenGenerator::validate() should do an identical compare. (CORE-SA-2013-003 follow-up)

Issue #2073531 by tim.plunkett, dawehner, Berdir, catch, plach: Use current user service instead of _account, remove _account from the request object.

Issue #2036351 by damiankloip, dawehner, Xano:  Convert CSRF tokens to a service  is broken for skip_anonymous().