Clean up ProviderUserIdSerializationHelper class to incorporate review feedback. Add clarification comments.
Removed unused internal code and fixed up related test to use [Theory] instead of hard-coded values.
Optional parameter fixes
There're currently two issues with our optional parameter support
1. The default value on the optional parameter is not applied when using FormatterParameterBinding
2. We don't recognize an optional parameter when the default value is null (tracked by http://aspnetwebstack.codeplex.com/workitem/148)

For #1, we've decided not to support it by throwing. It's relatively uncommon to have optional parameter for the body and the formatters should be the ones deciding what to return for the default values.
For #2, we're introducing IsOptional concept to HttpParameterDescriptor so we're not relying on the default value because it can be null for optional parameters.
Adding unobtrusive JavaScript files to System.Web.Mvc
Fix up package references from OAuth update
Fix unit tets failing.
Updated default content negotiation to take into account whether accept headers are matched by one of three possible accept header values

1) A literal media type, e.g. "application/json",
2) A subtype media range, e.g. "application/*", or
3) An all media range, e.g. "*/*.

Within the same band of q-factor values, e.g. "1.0", the preferred response media type is picked in the order 1), 2), 3). That is, an accept header value of "application/xml" is preferred to the less specific "application/*" which again is preferred to the less specific "*/*.

Examples of matches:

Accept: */*, application/xml
Response: application/xml

Accept: */*; q=1.0, application/*; q=1.0, text/xml; q=1.0
Response: text/xml

Accept: */*, text/*, text/xml; q=0.5
Response: text/json

Also fixed a bug in the quality comparer logic which didn't account appropriately for a q-factor of null (which is equivalent to 1.0).
Throw an exception for validation attributes on non-public properties and fields and for [Required] without [DataMember(IsRequired=true)] on value-typed properties
These fixes cover situations where users might think their validation is running, but it in fact isn't. Validation attributes only run for public properties. So any validation attributes on non-public properties and fields need to cause an exception to be thrown. Certain formatters (like XmlMediaTypeFormatter) don't recognize [Required]. So we need to throw an exception if [Required] is present without [DataMember(IsRequired=true)] to make sure that the formatters recognize the required member.
For clients, the experience in these cases is that they will get an HTTP InternalServerError. If the client is local, the exception message will appear which should allow the service author to diagnose the issue. The service author can choose to ignore these errors by removing the InvalidModelValidatorProvider from their configuration services for ModelValidatorProvider.
Issue 61 -- enable bufferless input stream in web-host

Fixes issue http://aspnetwebstack.codeplex.com/workitem/61

This change adds support for the developer to control whether request
input streams are buffered or unbuffered in a web-hosted environment.

This is done by registering an IHostBufferPolicySelector implementation
in the configuration (typically done in Global.asax.cs), such as:
   GlobalConfiguration.Configuration.Replace(typeof(IHostBufferPolicySelector), new MySelector());

If this implementation returns true from UseBufferedInputStream(Request), the input
stream will be buffered.  If the implementation returns false, it will be unbuffered.

By default, request input streams are always buffered.
Zero ContentLength without content type header in body is throwing
The selection of formatters will depend on content-type header. That means when there's no content-type, no formatter will be selected, and the parameter pick up the default value.
Cleanup from the earlier Anti-XSRF DCR:

- Refactored types so that the dependency chain is initialized in a single place rather than having each component create a default instance of its dependencies.

- Use the 4.5 MachineKey APIs if the application is targeting 4.5.
Issue 141: DefaultHttpControllerActivator will bypass dependency resolver if fastcache exists but not meet
Fix earlier commit (Issue 141 5ac8586b78b3) to maintain the fastCache
beahvior in DefaultHttpControllerActivator.
[System.Net.Http.dll] Backport the changes on v4 back to v2
Updating the solution references to the latest System.Net.Http package
Added missing package to WebStackNuGetPackages list
Change display name for Microsoft accounts registered via OAuthWebSecurity.RegisterMicrosoftAccount() to "Microsoft" to match other login providers.
Add a check to MVC's GlobalFilterCollection to reject filter instances that do not implement one of the 4 MVC filter interfaces.
The purpose of this change is to avoid situations where WebAPI filters are passed into MVC, at which point they would be ignored.
Cache the results of ModelValidatorProviders across model binding and value validation

ModelValidatorProviders can be slow since they may reflect over types to decide what validators to provide. So it is important that the results are cached so that runtime performance isn't affected by slow validator providers on every request. This changeset introduces an internal cache on the configuration properties used to cache the validators that will be provided for a given type or property. This cache only applies to the use of the extension method actionContext.GetValidators(metadata) and its callers.
Code Review feedback for ModelValidator Cache - Check that the service is not null instead of using IsSingleService
420317: Remove Obsolete SecurityUtil from Webpages and MVC

The type was originally created to make MVC and WebPages respect the <trust> element when running in legacy CAS mode.  But since MVC and WebPages don't support legacy CAS mode any more, the type is just no-oping when it runs, not doing anything useful.  It is vestigial and can be removed.