[Security] limited the password length passed to encoders
updated CHANGELOG for 2.2.9
update CONTRIBUTORS for 2.2.9
updated VERSION for 2.2.9
bumped Symfony version to 2.2.10
fixed wrong started states
bug #9246 [Session] fixed wrong started state (tecbot)

This PR was submitted for the master branch but it was merged into the 2.2 branch instead (closes #9246).

Discussion
----------

[Session] fixed wrong started state

Currently the session stays in the started mode after the call of  ```save()``` which will close the session. We found the issue in our custom SAPI which keeps the symfony stack initialized over multiple requests.

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

d641cd6 [Session] fixed wrong started states
Fix in ChainLoader.php

The LoaderInterface requires the time to be passed.
bug #9270 [Templating] Fix in ChainLoader.php (janschoenherr)

This PR was submitted for the master branch but it was merged into the 2.2 branch instead (closes #9270).

Discussion
----------

[Templating] Fix in ChainLoader.php

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

The LoaderInterface requires the _time_ parameter to be passed.

Commits
-------

2631eb3 [Templating] Fix in ChainLoader.php