Fixed #19130 -- Made some of the auth forms more flexible for user models.
Fixed #18548 - Clarified note regarding reusing model instances when form validation fails.
Reported OpenLayersWidget exceptions through logging
Fixed #18473 - Fixed a suggestion that GZipMiddleware needs to be first in the list of middleware.
Fixed a security issue related to password resets

Full disclosure and new release are forthcoming
Fixed an error in cookie documentation
Fixed #19132 -- Added example for creating custom lazy function

Thanks flagzeta@yahoo.it for the report and Luke Plant for his
expert assistance.
Added missed poisoned host header tests
Fixed #18046 - Documented than an index is created by default for ForeignKeys; thanks jbauer for the suggestion.
Fixed #8001 -- Made redirections after add/edit in admin customizable.

Also fixes #18310.
Fixed #17388 - Noted in the custom model field docs that field methods need to handle None if the field may be null.
Fixed #19133 -- Corrected regression in form handling for user passwords.

Thanks to pressureman for the report, and to Preston Holmes for the draft patch.
Fixed #19150 -- Added validation for USERNAME_FIELD being included in REQUIRED_FIELDS.

Thanks to Chris Pagnutti for the suggestion.
Separated GIS installation docs in sections
Removed custom WSGIRequestHandler.get_environ

We probably historically customized it for good reasons, but
currently, the differences with upstream Python are not
significant any longer.
Also fixes #19075 for which a test has been added.
Fixed #17006 - Documented ModelAdmin get_form() and get_formsets()
Fixed #5611 -- Restricted accepted content types in parsing POST data

Thanks paulegan for the report and Preston Holmes for the review.
Fixed #19094 -- Improved FakePayload to support write, len and string input

Thanks Ondrej Slinták for the suggestion.
Fixed #17856 -- Passed obj to get_inline_instances

Thanks ybon, quinode and sjaensch for the patch, and Tim Graham
for the review.
Used FakePayload in requests tests