[1.5.x] Documentation -- added instructions on working with pull requests

Since non-core contributors are asked to review patches, instructions
on working with pull requests were added to the Working with Git and
GitHub page (based on the existing instructions in the core
committers page).

Backport of 990ce9aab9 from master
[1.5.x] Fixed #21094 -- Updated reuseable apps tutorial to use pip for installation.

Thanks ylb415 at gmail.com for the suggestion.

Backport of e4aab1bb8d from master
[1.5.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master
[1.5.x] Fixed #21101 -- Updated urlize documentation to mention email addresses

Backport of 39b49fd339 from master
Fixed #21102 -- pickling a QuerySet with prefetches twice

Fixed the bug that a QuerySet that prefetches related objects cannot be
pickled and unpickled more than once (The second pickling attempt
raises an exception).

Added a new test for the queryset pickling idempotency.

The bug was introduced by
bac187c0d8e829fb3ca2ca82965eabbcbcb6ddd5.
[1.5.x] Ensure that passwords are never long enough for a DoS.

 * Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
 * Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
[1.5.x] Add release notes and bump version numbers for 1.5.4 security release.
[1.5.x] (Hopefully) fixed a failure in a selenium test.

No forward port to 1.6 since it has new transactionmanagement. The
wait_page_loaded should ensure that the liveserver has time to tear
down properly after the submit.
[1.5.x] Bump version post-release.
[1.5.x] Cleaned up 1.5.4/1.4.8 release notes

Backport of 8d29005524 from master
[1.5.x] Reworded a paragraph in the logging docs.

9d12f68a53 from master.
[1.5.x] Final attempt to solve sporadic test failures.

tearDownClass is not called if setUpClass throws an exception, in our case
this means that LiveServerTestCase leaks LiveServerThread sockets if the
test happens to be skipped later on, and AdminSeleniumWebDriverTestCase
doesn't close it's already open browser window. To prevent this leakage
we catch errors where needed and manually call _tearDownClassInternal.
_tearDownClassInternal should be written as defensively as possible since
it is not allowed to make any assumptions on how far setUpClass got.

This patch should fix the sporadic "Address already in use"-errors on jenkins
and also the "This code isn't under transaction management"-error for sqlite
(also just on jenkins).

After discussion with koniiiik, jezdez, kmtracey, tos9, lifeless, nedbat and
voidspace it was decided that this is the safest approach (thanks to everyone
for their comments and help). Manually calling tearDownClass was shut down
cause we don't know how our users override our classes.

This is a private and very specialized API on purpose and should not be used
without a strong reason!

This patch partially reverts the earlier attempts to fix those issues,
namely:
	2fa0dd73b18f55d0fdd1c1d54b1d18031bfcf1ed and
	3c5775d36f7e431d9691829a78580873111cb714

Final note: If this patch breaks in a later version of Django, please be
very careful on how you fix it, you might not see test failures locally.
That said, this patch hopefully doesn't produce even more failures.

Backport of 73a610d2a81bc3bf2d3834786b2458bc85953ed0 from master.
[1.5.x] Silenced last sporadic failure on 1.5.

This commit is a last resort; technically the test is correct but our testsuite
has some threading issues when LiveServer is used. Since this will never get
fixed in 1.5 and apperently doesn't get triggered on 1.6 we just make sure the
test doesn't error out. I am not 100% sure why this actually fixes the issue,
but this is still better than having failing builds wheneever we do a security
release for 1.5.

(Tested on jenkins itself, should work (tm)).
[1.5.x] Fixed #21118 -- Isolated a test that uses the database.

Thanks rmboggs for the report.

Backport of 4f40b97d97 from master
Revert "[1.5.x] Silenced last sporadic failure on 1.5."

This reverts commit 6a708cd654fe63278ea8a14b3e44da847c62ebf4.

Reverted since it only moved the failures to some other tests and it apperently
only worked by accident. Patched selenium for now to include:
https://github.com/SeleniumHQ/selenium/pull/118
which seems to be the root cause for sporadic extra requests to the live server,
which then cause all sorts of issues.
[1.5.x] Fixed #21121: Added archive of security issues.

Backport of 9d3e60a, 8e134c2, 8b3bae9, c65ae7c, bbabc53,
and a2e25e8 from master.
[1.5.x] Added __pycache__ to gitignore

Backport of 55b9bff07f from master
[1.5.x] Added missing "in" in sentence.

Backport of 2c5c422d34 from master
[1.5.x] Fixed #21133 -- Clarifed documentation about strftime formatting.

Backport of 43a2ec7999 from master
[1.5.x] Fixed #21137 -- Documented best practice for URLconfs with repeated pattern prefixes.

Backport of 222460a994 from master