Fixed a typo in the test suite that was causing some spurious failures with pypy.
Fixed #15808 -- Added optional HttpOnly flag to the CSRF Cookie.

Thanks Samuel Lavitt for the report and Sascha Peilicke for the patch.
Fixed #19756 - Corrected a ManyToMany example and added some links and markup.
Fixed #19706 - Tweaks to the tutorial.

Thanks Daniele Procida.
Updated createsuperuser to use unicode_literals. Refs #19757.
Fixed #19662 -- alter auth modelbackend to accept custom username fields

Thanks to Aymeric and Carl for the review.