Issue #2464659 by Wim Leers, rteijeiro: Routes that are varied by the 'user.permissions' cache context for anonymous users must also get the anonymous Role's cache tag

Issue #2444231 by Wim Leers, nlisgo: Fix CacheableInterface so it makes sense (was: "Make Config objects & Entities implement CacheableInterface + add BubbleableMetadata::createFromCacheableObject()")

Issue #2458349 by Wim Leers: Route's access result's cacheability not applied to the response's cacheability

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2372011 by richardcanoe, Noe_: NotFoundHttpException handler should take into account it's parameters

Issue #2452247 by rteijeiro, joshi.rohit100: Incorrect constructor docblock for RequestCloseSubscriber

Issue #2455083 by dawehner, larowlan, klausi, David_Rothstein, hefox, tsphethean, dstol, DamienMcKenna, Pere Orga, benjy: Open redirect fixes from SA-CORE-2015-001 need to be ported to Drupal 8

Issue #2286971 by znerol, Berdir, almaudoh, cilefen: Remove dependency of current_user on request and authentication manager

Issue #2453351 by effulgentsia, Wim Leers: Maintenance mode message ends up in page cache, served endlessly

Issue #356399 by dawehner, beejeebus, catch, sidharrell, klausi, nlisgo, Josh Waihi, Berdir, martin107: Optimize the route rebuilding process to rebuild on write

Issue #2450383 by joshi.rohit100, martin107: Two incorrectly titled Subscriber constructor functions

Issue #2339491 by corbacho, dawehner, larowlan, effulgentsia, webflo: Ajax requests on forms with files fail on IE 9

Issue #2229145 by znerol, neclimdul, larowlan, alexpott, joelpittet, almaudoh, tadityar: Register symfony session components in the DIC and inject the session service into the request object

Revert "Issue #2229145 by znerol, neclimdul, larowlan, joelpittet, almaudoh: Register symfony session components in the DIC and inject the session service into the request object"

This reverts commit b926f5d8.

Issue #2229145 by znerol, neclimdul, larowlan, joelpittet, almaudoh: Register symfony session components in the DIC and inject the session service into the request object

Issue #2417645 by tim.plunkett, effulgentsia, pwolanin: Change destination query string handling to break dependence on system path

Issue #2348679 by znerol, Wim Leers: Move the remaining procedural page cache code to the page cache stack middleware

Issue #2350837 by dawehner, Berdir, larowlan, Wim Leers: Convert most usages of EntityInterface::getSystemPath() to use routes

Issue #462950 by pwolanin: Mitigate the security risks that come from IE and other browsers trying to sniff the mime type

Issue #2386571 by dawehner, hussainweb: Large array structures (e.g. $form) in stack trace results in huge memory usage in FlattenException::flattenArgs()

Issue #2368275 by martin107, dawehner, znerol, Crell, Wim Leers: EntityRouteEnhancer and ContentFormControllerSubscriber implicitly depend on too many services

Issue #2362517 by Wim Leers: Improve default 403/404 exception HTML subscriber: don't duplicate the page render pipeline, use the routing system — add system.403 and system.404 routes.

Issue #2239003 by Wim Leers, dawehner | effulgentsia: Remove the '_http_statuscode' request attribute.

This reverts commit 0faa5ce3.

Issue #2361681 by Wim Leers: drupal_render(): invert second argument ($is_recursive_call -> $is_root_call) => more strict, better DX/TX.