allow callbacks to modify attachements by moving the decision to calculate boundary value into the correct position inside _render()
Set extension with multiple accept based on order in parseExtensions, currently with multiple accepted types, no extension is set at all
Add emailRegex property to CakeEmail
CakeEmail be able to setting custom email validation rule
Test to proof that render itself should handle the boundary.
also move protected variable resetting into the correct scope
CakeEmail::emailRegex() change to null default value
Fix for #3318

Fixes https://cakephp.lighthouseapp.com/projects/42648-cakephp/tickets/3318

It seems fixing this in the htaccess file(s) isn't going to work even though a url rewriting based solution was more clean. On the plus side this works for any web server.
If a url is called with "index.php" in it then the CakeRequest swallows this part and fixes the path. Any linked url from the requested page will have a clean url. Thus after following one of these urls this problem is gone anyway.

Some code docblock improvements to CakeRequestTest.php
Added test case for fix
Also now you can call just index.php even if you have url rewriting enabled
change emailRegex to emailPattern
Typo in FormAuthenticate.php
Merge pull request #1388 from ravage84/patch-1

Typo in FormAuthenticate.php
Merge pull request #1380 from ceeram/2.4-ext

Set extension with multiple accept based on order in parseExtensions.
Made _stop() usage in Consoles / Tasks more consistent
Merge pull request #1389 from tersmitten/consistent-usage-of-stop

Made _stop() usage in Consoles / Tasks more consistent
Merge pull request #1375 from dereuromark/master-cake-email

Move boundary calculation inside _render()
Merge pull request #1386 from nojimage/cakeemail-custom-email-validation

CakeEmail class be able to setting custom email validation rule.
Don't load classnames with `..` in their names.

Classnames with . in them are invalid and can be leveraged to load code
outside of an application by traversing directories.
Hash passwords even when users don't exist.

Not hashing passwords when users don't exist means there is an
opportunity for timing attacks when people use blowfish or other
expensive hashing algorithms.
Merge pull request #1377 from ravage84/fix-for-3318

Trim off webroot/index.php when determining base and url.

Trimming off index.php from url and webroot/index.php from base url allows the correct values to be created when a path contains index.php in it.

Fixes #3318
Fix coding standards.