Issue #2753681 by tedbow, Wim Leers, dawehner, neclimdul, catch: Move CSRF header token out of REST module so that user module can use it, as well as any contrib module

Issue #2158571 by tstoeckler, dawehner, kgoel, tim.plunkett, catch, effulgentsia: Routes added in RouteSubscribers cannot be altered.

Issue #2051097 by dawehner, Manuel Garcia, tlattimore, neclimdul: Change 'pattern' to 'path' in *.routing.yml files.

Issue #1891052 by klausi: Fixed Protect write operations from CRSF by requiring an token (when using cookie/session-based authentication).