Issue #2936253 by gabesullice: Clarify usage of AccountProxyInterface: recommend AccountInterface for most use cases

Issue #2932774 by harsha012, gaurav.kapoor, neelam.chaudhary, dpi: Update docs for getEmail, can return null

Issue #2854529 by alexpott, xjm, klausi, Chi, Mixologic: Fix Drupal.Scope.MethodScope - all methods should have scopes

Issue #2776975 by joelpittet, dawehner, tim.plunkett, xjm, pfrenssen: March 3, 2017: Convert core to array syntax coding standards for Drupal 8.3.x RC phase

Issue #2794089 by Wim Leers, yobottehg, slashrsm: SessionManager::destroy() is incompatible with streamed responses: tries to send response header after headers have already been sent, causing watchdog to fill up with PHP warnings

Issue #2783393 by Mile23: Fix 'Drupal.Commenting.FunctionComment.IncorrectParamVarName' coding standard

Issue #2697909 by pguillard, himanshugautam, snehi, aburrows, jhodgdon: Fix "login (noun/adjective)" vs. "log in (verb)" in comments (and logout/log out)

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

Issue #2510150 by tduong, Berdir: AccountProxy is not calling date_set_default_timezone() for anonymous users

Issue #2623790 by roderik, priya.chat, stefan.r: Update SessionManager::migrateStoredSession() method comment

(cherry picked from commit 820b2f53)

Issue #2576533 by alexpott, stefan.r, Wim Leers, dawehner, xjm, effulgentsia, catch: Rename SafeStringInterface to MarkupInterface and move related classes

Issue #2112679 by Berdir, damiankloip, nlisgo, krlucas, lokapujya, m1r1k, piyuesh23, blueminds, stefan.r, subhojit777, dawehner, kerby70, Dustin LeBlanc, znerol, JeroenT, borisson_, scor, amitgoyal, s_leu: getUsername() should return the username getDisplayName() for the formatted user name

Issue #2545972 by alexpott, joelpittet, ericjenkins, stefan.r, Wim Leers, Cottser: Remove all code usages SafeMarkup::checkPlain() and rely more on Twig autoescaping

Issue #2501117 by catch, olli, Wim Leers, dawehner: Add static caching for PermissionsHashGenerator::generate()

Issue #2522002 by pwolanin, fgm, znerol: Do not strip www. from cookie domain by default because that leaks session cookies to subdomains

Issue #1392754 by tss, justAChris, jhodgdon: Comply with new documentation standards for @file for namespaced class files

Issue #2417895 by David_Rothstein, Berdir, Wim Leers, willzyx, catch: AccountPermissionsCacheContext/PermissionsHashGenerator must special case user 1, since permissions don't apply to it

Issue #2491155 by mikeburrelljr, Mac_Weber, opdavies: Update drupal.org and kernel.org URLs in core modules (Follow-up to 2489912)

Issue #2347799 by andypost, almaudoh, znerol: Remove bugged session-related methods from AccountInterface

Issue #2228393 by almaudoh, andypost, pfrenssen, znerol, cpj, Dom.: Decouple session from cookie based user authentication

Issue #2437761 by Dom., znerol: CSRF token seed and possibly other session data lost when set after a session regenerate

Issue #2463321 by amateescu: Serializing the database connection is dangerous and error-prone, make it unserializable again

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2428703 by Wim Leers: Add a 'user.permissions' cache context (was: "Should cache contexts be able to associate a cache tag?")

Issue #2286971 by znerol, Berdir, almaudoh, cilefen: Remove dependency of current_user on request and authentication manager

Issue #2421263 by alexpott, formatC'vt, kim.pepper, andypost, larowlan, chx: Potential data loss: concurrent (i.e. by different users) node edits leak through preview

Issue #2429103 by cpj: Remove deprecated methods SessionManager::enable(), SessionManager::disable() and SessionManager::isEnabled()

Issue #2426031 by almaudoh, cpj: Remove deprecated uses of SessionManager::isEnabled(), SessionManager::enable() and SessionManager::disable()

Issue #2229145 by znerol, neclimdul, larowlan, alexpott, joelpittet, almaudoh, tadityar: Register symfony session components in the DIC and inject the session service into the request object