Added a test that shows that a HEAD request does not normally pass CSRF protection
Added request.head? to forgery protection code
Improve String#squish whitespaces matching
Use already defined Encoding constants rather than creating one-trip Strings
Use Encoding::UTF_8 constant :do_not_litter:
Merge pull request #9032 from firmhouse/head-breaks-csrf

Make HEAD work / convert to GET once more
explains why the query cache checks arel.locked
updates a dynamic method heredoc doc
Remove caching_allowed? from ActionController::Caching

Where is this used? No other code references to this method and it
isn't being tested anywhere. No tests fail when commented out.
Make current_url? work with a HEAD method

ActionDispatch::Head was removed in favor of Rack::Head. But Rack::Head
does not convert GET requests to HEAD requests so we need to do
checking for HEAD requests ourselves.
Added a Changelog entry for fixing HEAD requests.
Merge pull request #9098 from firmhouse/add-head-requests

Make current_url? work with HEAD requests and remove caching_allowed? since it doesn't do anything
Merge pull request #8830 from antoinelyset/master

Improve String#squish whitespaces matching
no need for \Z, \z is more concise
Move AS changelog entry to the top, improve AP changelog a bit

[ci skip]