Major TaskHelpers.Iterate perf wins. Create a fast-path for Task so that synchronous tasks execute immediately and we avoid any task allocations. This reduces iteration overhead to nearly 0.
Remove iteration over Task<T> since nobody used it and it's slow.

Ensure that in task.Finally(), original task exception is observed even if finally clause throws.

Add some unit tests to the task finally extensions.Ensure that the exception from a finally clause is the one that propagates.
Remove IHttpControllerActivator.Release()
bug fix 395547: Addressing the issue that caused stress test failure on 4.5 where 401 response message sent is received as 500 error
Performance improvements around simple parameters from the query string.  This gets about a 2x win in the case of calling get(int,int,int) in an in-memory loop.

Reorder the value provider factory and model binder providers to put the most common at the top.
Put TypeConverter and QueryStringProvider at the top. If we only pull from the query string (and have no misses), this avoids even invoking the other model binders or the route value provider.

Per-request caching QueryString and RouteValue providers so that we can reuse them across parameters. We shouldn't be parsing the query string for every parameter in a request.
Use array instead of IEnumerable. Avoids expensive ToList with ValueProviderFactories. No downside here and it gets about a 15% improvement in scenario.

Avoid ToList() calls in composite model binder. If we already have the array, use that.
Responding to customer and partner feedback re: the Anti-XSRF helpers.

What's new:
- Programmatic configuration over various Anti-XSRF behaviors:
-> The name of the cookie to use.
-> Whether SSL is required.
-> Ability to provide a nonce or other "custom data".
- The exception message is now a little less cryptic.  It tells you exactly what check failed (e.g. the cookie 'foo' was missing, the token was meant for a different user, etc.).
- The system tries to detect if the current identity is degenerate (e.g. authenticated but without a name) and fails safe. The exception message specifies how to resolve the problem. (This check can be suppressed via config if necessary.)
- Ability to get the cookie and form token strings directly if you want more manual control.
- Built-in support for OpenID and Azure ACS (WIF).
- For most consumers, the token size is smaller.

Breaks:
- The salt / domain / path parameters are all obsolete as error. The customer can achieve the same effect by using the <httpCookies> configuration element or calling the AntiForgery.* APIs that are string-based.
- Not compatible with MVC 1 / 2 / 3. However, this system makes it easier to recover gracefully when an old token is submitted.

CR: marcind; bradwils
SR: naziml
Added copyright headers and License.txt
Value Validation Performance Improvements
Code review feedback from bug #26
perf: Optimize return value validation of methods returning a non-generic Task.
A direct comparison of the type to typeof(Task) is faster than analyzing if the type is generic or not.
Perf: improve conneg accept header sorting

- only sort if there are more than 1 items
- comparer fast path when comparing the same instance
Issue 41: fix problem with Web API running in medium trust from the GAC

Fix a bug where WebAPI would cause an error for action methods returning Task<T> when running in Medium trust from the GAC.
Instead of using Expression tree compilation, use Delegate.CreateDelegate which does not have the same access violation problem.
Incorporate code review feedback for ResultConverters

- Reuse singleton converter instances where possible.
- Throw on null controllerContext
More Validation Performance Improvements
44: Updated XML docs for IDependencyScope
Add MaxHttpCollectionKey support
Fix bug in OAuthWebSecurity passing wrong parameters when deleting an OAuth account from simple membership.
Add unit test for the PreAppStartCode class.
Modifying NuGet.targets file to download NuGet.exe from API path
Update JsonMediaTypeFormatter to use Json.NET v4.5.3
Change in ModelBinderProvider contract.

Make ModelBinderProvider.GetBinder() take a Type instead of an ActionContext.
This allows fetching an IModelBinder per parameter binding, rather than per request.
There's a significant perf win here, and it also simplifies the code.

There are some subtle differences here. Mainly, before, GetBinder() had the action context, so it could be very accurate about whether to return a binder.
Now, since GetBinder() just has a type, it errs on returning a binder instead of null.
Practically, this means that GetBinder() returns non-null more often than before. But it doesn�t really matter since IModelBinder.BindModel() can still return false.

There are some public interface changes here, notably:
- ModelBinderProvider.GetBinder() now takes a Type
- parameter bindings can take a IModelBinder rather than a provider.
- CompositeBinder can take a IModelBinder rather than a provider