Issue #2476407 by borisson_, hussainweb, znerol, Fabianx, Wim Leers, dawehner, Crell, Berdir: Use CacheableResponseInterface to determine which responses should be cached

Issue #2575615 by alexpott, pwolanin, stefan.r, catch, dawehner, effulgentsia, xjm, David_Rothstein, iMiksu, lauriii, joelpittet: Introduce HtmlEscapedText and remove SafeMarkup::setMultiple() and SafeMarkup::getAll() and remove the static safeStrings list

Issue #2576533 by alexpott, stefan.r, Wim Leers, dawehner, xjm, effulgentsia, catch: Rename SafeStringInterface to MarkupInterface and move related classes

Issue #2546176 by alexpott: Use SafeStrings to communicate safeness in drupal_set_message and remove SafeMarkup::set()

Issue #2517114 by joshi.rohit100, cilefen: Remove needless, wrongly-placed system_test.permissions.yml file

Issue #1392754 by tss, justAChris, jhodgdon: Comply with new documentation standards for @file for namespaced class files

Issue #2481453 by dawehner, pwolanin, rteijeiro, neclimdul, znerol: Implement query parameter based content negotiation as alternative to extensions

Issue #2463009 by Wim Leers: Introduce CacheableResponseInterface: consolidate ways of setting X-Drupal-Cache-Tags/Contexts headers

Issue #2467041 by mr.baileys, jan.stoeckler: max-age on HTML responses wrongly set to `max-age=0, private` instead of `max-age=N, public` (breaks reverse proxies and client-side caching)

Issue #2464659 by Wim Leers, rteijeiro: Routes that are varied by the 'user.permissions' cache context for anonymous users must also get the anonymous Role's cache tag

Issue #2461087 by Wim Leers, dawehner: Add 'no_cache' route option to mark a route's responses as uncacheable (was: Cron run response should not be cacheable)

Issue #2455083 by dawehner, larowlan, klausi, David_Rothstein, hefox, tsphethean, dstol, DamienMcKenna, Pere Orga, benjy: Open redirect fixes from SA-CORE-2015-001 need to be ported to Drupal 8

Issue #1987832 by aspilicious, disasm, webflo, vijaycs85, adci_contributor, vks7056: Convert system_test callbacks to a new style controller

Issue #2363139 by Wim Leers, dawehner, larowlan: _content controllers may only return render arrays, not strings.

Issue #2205527 by cilefen, alexpott, martin107, Xen, Gaelan, clintrandall777@gmail.com: Fixed Move configuration import lock to lock.persistent service since a lock can not exist beyond a single request.

Issue #2184907 by JeroenT, ParisLiakos, ianthomas_uk, hussainweb, dawehner: Remove uses of drupal_add_http_header and related functions.

Issue #1946240 by eiriksm, David_Rothstein, Yaron Tal, madhusudanmca, rszrama: Remove the hardcoded 0 index in status-messages.html.twig.

Issue #2340123 by Wim Leers: Setting cache tags can be tricky: use strings instead of nested arrays to improve DX.