Issue #2444231 by Wim Leers, nlisgo: Fix CacheableInterface so it makes sense (was: "Make Config objects & Entities implement CacheableInterface + add BubbleableMetadata::createFromCacheableObject()")

Issue #2428703 by Wim Leers: Add a 'user.permissions' cache context (was: "Should cache contexts be able to associate a cache tag?")

Issue #2443073 by Wim Leers, joshtaylor: Add #cache[max-age] to disable caching and bubble the max-age

Issue #2329101 by Wim Leers: CacheableInterface only has a getCacheKeys() method, no getCacheContexts(), leads to awkward implementations

Issue #2417793 by effulgentsia, Wim Leers, YesCT, yched, dawehner: Allow entity: URIs to be entered in link fields

Issue #2040135 by Wim Leers, Berdir: Caches dependent on simple config are only invalidated on form submissions

Issue #1986640 by Wim Leers, chx, dawehner, effulgentsia: Support AND/OR conjunctions for permission checks.

Issue #2340123 by Wim Leers: Setting cache tags can be tricky: use strings instead of nested arrays to improve DX.

Issue #2293501 by dawehner, Wim Leers, znerol: Use route name and params instead of _system_path in CsrfAccessCheck.

Issue #2331079 by znerol, dawehner: Use RouteMatch in access-checks and remove RequestHelper::duplicate().

Issue #2256257 by znerol, cosmicdreams | YesCT: Move token seed in SessionManager in isSessionObsolete() and regenerate()  to the MetadataBag.

Issue #2265939 by tim.plunkett, dawehner, effulgentsia: Fixed [sechole] AccessManager::checkNamedRoute() leaks attributes from current request.

Issue #2310705 by lokeoke, tim.plunkett, dawehner: AccessManager should introduce constants for 'ANY' / 'ALL'.

Issue #2284103 by alexpott, fabpot, damiankloip, Xano, Xen, Berdir: Fixed Remove the request from the container.

Issue #2239009 by effulgentsia, dawehner: Remove public direct usage of the '_system_path' request attribute.

Issue #2222719 by effulgentsia, tim.plunkett, xjm, dawehner: Use parameter matching via reflection for access checks instead of pulling variables from request attributes.

Issue #2245003 by znerol, YesCT, sun, damiankloip: Use a random seed instead of the session_id for CSRF token generation.

Issue #2245117 by znerol: Remove the optional $skip_anonymous parameter from CsrfTokenGenerator::validate and remove the dependency on current_user service.

Issue #2228341 by sun, znerol, skipyT, ParisLiakos: Objectify session management functions + remove session.inc.

Revert "Issue #2201919 by damiankloip: Replace drupal_get_hash_salt() with direct Settings call in CsrfTokenGenerator."

This reverts commit aad87a80.

Issue #2201919 by damiankloip: Replace drupal_get_hash_salt() with direct Settings call in CsrfTokenGenerator.

Issue #2188289 by Jaypan, sun, jibran, Berdir: fix up docs for token functions and methods in regards to anonymous users and sessions

Issue #2185831 by tim.plunkett: Split up ParamConverterManager and stop throwing NotFoundHttpException.

Issue #2181293 by pwolanin, dawehner: AccessManager::checkNamedRoute() is not passing all route defaults (or building a complete route request).

Issue #2109035 by tim.plunkett, damiankloip, dawehner, chx: Make access checkers (much) easier to find.