Enabled clickjacking protection by default.
Enabled the locale middleware by default.

USE_I18N is True by default, and doesn't work well without
LocaleMiddleware.
Moved logging config for email notifications of 500 error in the docs.
Removed MEDIA_ROOT/URL from default settings template.

Many sites will never deal with user-uploaded files, and MEDIA_ROOT is
complicated to explain.

Thanks Carl Meyer for the suggestion.
Removed STATIC_ROOT from the default settings template.

It isn't necessary in development, and it confuses beginners to no end.

Thanks Carl Meyer for the suggestion.
Used an absolute path for the SQLite database.

This ensures the settings file works regardless of which directory
django-admin.py / manage.py is invoked from.

ROOT_DIR got a +1 from the BDFL and another core dev. It doesn't involve
the concept of a "Django project"; it's just a convenient way to express
relative paths within the source code repository for non-Python files.

Thanks Jacob Kaplan-Moss for the suggestion.
Added security warnings for the most sensitive settings.
Adjusted the default URLconf detection to account for the admin.

It's now enabled by default.
Updated tutorial 1 for the new project template.
Updated tutorial 2 for the new project template.
Minor fixes in tutorials 5 and 6.
Documented the simplified app & project templates in the changelog.