Issue #2512734 by Wim Leers, dawehner, Berdir: session_test routes/controllers don't specify the appropriate cacheability metadata

Issue #2283637 by pfrenssen, dawehner, shivanshuag, znerol: Provide test coverage to prove that an AuthenticationProvider can initiate a session

Issue #2468873 by pfrenssen, Dom., dawehner, znerol, xjm: Test that the authentication provider doesn't leak authentication credentials from the previous request

Issue #2437761 by Dom., znerol: CSRF token seed and possibly other session data lost when set after a session regenerate

Issue #2245003 by znerol, YesCT, sun, damiankloip: Use a random seed instead of the session_id for CSRF token generation.

Issue #2177093 by sun, alexpott, InternetDevels, Xano: Remove 'access content' permission from all test module routes.

Issue #2068471 by dawehner, Crell, tim.plunkett, jibran, fubhy, larowlan: Normalize Controller/View-listener behavior with a Page object.

Issue #2051097 by dawehner, Manuel Garcia, tlattimore, neclimdul: Change 'pattern' to 'path' in *.routing.yml files.

Issue #1981368 by tim.plunkett, Crell, webchick: Convert all routes to 'module_name().foo_bar()' naming convention.

Issue #1987572 by mrded, vijaycs85, Sean Buscay: Convert session_test() callbacks to a new style controller.