[FrameworkBundle] made sure that the debug event dispatcher is used everywhere
prevent PHP from magically setting a 302 header, see http://www.php.net/manual/en/function.header.php
[FrameworkBundle] Only enable CSRF protection when enabled in config
feature #9252 [FrameworkBundle] Only enable CSRF protection when enabled in config (asm89)

This PR was squashed before being merged into the master branch (closes #9252).

Discussion
----------

[FrameworkBundle] Only enable CSRF protection when enabled in config

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | maybe?
| Deprecations? | no
| Tests pass?   | I hope, master was already broken here
| License       | MIT

https://github.com/symfony/symfony/commit/bf85e8365ab8aec8799c8207f32598ab09d95183 introduced new service configuration for CSRF protection in the frameworkbundle. It is always enabled even if you don't use it. Since it also depends on enabling the session that's not so nice.

Commits
-------

60dce14 [FrameworkBundle] Only enable CSRF protection when enabled in config
feature #9365 prevent PHP from magically setting a 302 header (lsmith77)

This PR was merged into the master branch.

Discussion
----------

prevent PHP from magically setting a 302 header

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | yes (for people relying on getting a magic 302 when setting a Location header)
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

this needs a test case .. but first let me know if you are ok with this change.
see http://www.php.net/manual/en/function.header.php

Commits
-------

c140d4f prevent PHP from magically setting a 302 header, see http://www.php.net/manual/en/function.header.php
[Form] Fixed form debugger to work even when no view variables are logged  (e.g. upon redirects)
bug #9394 [Form] Fixed form debugger to work even when no view variables are logged (bschussek)

This PR was merged into the master branch.

Discussion
----------

[Form] Fixed form debugger to work even when no view variables are logged

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #9331
| License       | MIT
| Doc PR        | -

Commits
-------

99a4b7e [Form] Fixed form debugger to work even when no view variables are logged  (e.g. upon redirects)
bug #9168 [FrameworkBundle] made sure that the debug event dispatcher is used everywhere (fabpot)

This PR was merged into the master branch.

Discussion
----------

[FrameworkBundle] made sure that the debug event dispatcher is used everywhere

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #6686, #7673
| License       | MIT
| Doc PR        | n/a

The removal of the Profiler dependency on the TraceableEventDispatcher (#9170) allows to remerge the patch from #9068 that fixes #6686.

This PR also cleans up how profiles are stored. A Profile is now always stored only once.

The fix will only be available on 2.4+ as the changes are too deep to be backported to 2.2 and 2.3.

Commits
-------

1e1835e [FrameworkBundle] made sure that the debug event dispatcher is used everywhere