Issue #2257835 by tim.plunkett, sun, Jalandhar: Move form submission logic out of FormBuilder into a new class.

Issue #2079797 by ParisLiakos, Xano, amateescu, tim.plunkett: Provide a trait for $this->t() and $this->formatPlural().

Issue #2174443 by mr.baileys, David_Rothstein: Add security hardening protection option for programmatic form submissions to Drupal 8 (and backport to Drupal 6?).

Issue #1978924 by tim.plunkett, ParisLiakos, disasm, Luxian, vijaycs85, YesCT, vaibhavjain, Pancho: Convert locale_translate_export_form to a Controller.

Issue #2140433 by pwolanin, chx, Owen Barton, dstol, Heine, Damien Tournoud: Port SA-CORE-2013-003 to Drupal 8.

Issue #1217840 by tim.plunkett: Use unset() instead of array_shift() to remove arguments from func_get_args().

Issue #2147153 by dawehner, alexpott, Xano: Replace the last instance of $_GET/$_POST; Create a special exception listener / exception controller which allows to use POST requests.

Issue #2072995 by claudiu.cristea, yched: Change notice: Move FAPI callbacks for file/image widgets in classes.

Issue #1987716 by pfrenssen, tim.plunkett, kgoel: Provide a FormTestBase class to allow PHPUnit form tests.

Issue #2109793 by damiankloip, dawehner, tim.plunkett: Convert element_* methods in common.inc to a class.

Issue #1998638 by damiankloip, dawehner, kim.pepper, cosmicdreams, alexpott, larowlan, Damien Tournoud: Replace almost all remaining superglobals (, , etc.) with Symfony Request object.

Issue #2143349 by larowlan: Submitting a form as an anonymous user when $form['#token'] = FALSE results in a notice.

Issue #1998638 by damiankloip, dawehner, kim.pepper, cosmicdreams, larowlan, Damien Tournoud: Replace all remaining superglobals (, , etc.) with Symfony Request object.