add allow_extra_fields option
[SecurityBundle] added acl:set command
Allow overloading ContextListener::refreshUser()
Updated form dev dependencies
Fixed FormDataExtractorTest_SimpleValueExporter::exportValue not implementing the interface correctly
minor #10911 [Form] Composer dependencies (csarrazi)

This PR was merged into the 2.4 branch.

Discussion
----------

[Form] Composer dependencies

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Right now, launching tests from the Form component's directory doesn't work, due to missing dev dependencies. This should be merged back into master afterwards.

Also fixed a problem related to a bad method signature in ```Symfony\Component\Form\Tests\Extension\DataCollector\FormDataExtractorTest_SimpleValueExporter```

Commits
-------

7b5857c Fixed FormDataExtractorTest_SimpleValueExporter::exportValue not implementing the interface correctly
e4fa5d8 Updated form dev dependencies
[Security] removed an unused parameter in some private methods
minor #10923 [Security] removed an unused parameter in some private methods (issei-m)

This PR was merged into the 2.5-dev branch.

Discussion
----------

[Security] removed an unused parameter in some private methods

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

Commits
-------

f9f3852 [Security] removed an unused parameter in some private methods
Fixed the handling of boolean attributes in ChoiceFormField

An option is marked as selected by the presence of the selected attribute,
not by the presence of a non-empty selected attribute. The same is true
for checked radio buttons or checkboxes.
[DomCrawler] Fixed the initial state for options without value attribute
bug #10925 [DomCrawler] Fixed the handling of boolean attributes in ChoiceFormField (stof)

This PR was merged into the 2.3 branch.

Discussion
----------

[DomCrawler] Fixed the handling of boolean attributes in ChoiceFormField

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | n/a

An option is marked as selected by the presence of the selected attribute, not by the presence of a non-empty selected attribute. The same is true for checked radio buttons or checkboxes.

Commits
-------

b505708 Fixed the handling of boolean attributes in ChoiceFormField
bug #10926 [DomCrawler] Fixed the initial state for options without value attribute (stof)

This PR was merged into the 2.3 branch.

Discussion
----------

[DomCrawler] Fixed the initial state for options without value attribute

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | n/a

Commits
-------

78cff96 [DomCrawler] Fixed the initial state for options without value attribute
[HttpKernel] removed absolute paths from the generated container
bug #10894 [HttpKernel] removed absolute paths from the generated container (fabpot)

This PR was merged into the 2.3 branch.

Discussion
----------

[HttpKernel] removed absolute paths from the generated container

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | first step to resolve #6484, #3079, and #9238
| License       | MIT
| Doc PR        | n/a

This PR converts absolute paths to relative ones in the dumped container. The code is a bit "ugly", but it gets the job done and I'm not sure that there is a more elegant way without breaking everything.

Commits
-------

c1450b4 [HttpKernel] removed absolute paths from the generated container
[DomCrawler] Changed typehints form DomNode to DomElement

Closes #10924
[DomCrawler] Fixed the coding standards to use strict comparisons
[HttpFoundation] implement session locking for PDO
bug #10908 [HttpFoundation] implement session locking for PDO (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[HttpFoundation] implement session locking for PDO

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #4976 for PDO
| License       | MIT

This is probably the first Session Handler for databases that actually works with locking. I've seen many implementations of session handlers (mostly only for one database vendor) while researching and none used locking. Not even the [PHPs SQLite session handler](https://github.com/php/php-src/blob/PHP-5.3/ext/sqlite/sess_sqlite.c) or [PECL Postgres Handler](http://svn.php.net/viewvc/pecl/session_pgsql/trunk/session_pgsql.c?revision=326806&view=markup) implemented locking  correctly which is probably the reason why they have been discontinued. [Zend Session](https://github.com/zendframework/zf2/blob/master/library/Zend/Session/SaveHandler/DbTableGateway.php) seems not to use locking either. But it saves the lifetime together with the session which seems like a good idea because you could have different lifetimes for different sessions.

- Implements session locking for MySQL, Postgres, Oracle, SQL Server and SQLite.
Only tested it for MySQL. So would be good if someone can confirm it works as intended on the other databases as well.
- Also removed the custom RuntimeException which is not useful and a PDOException extends RuntimeException anyway, so no BC break.
- I added a default for the table name to be in line with the DoctrineSessionHandler.
- Check session.gc_maxlifetime in read(). Imagine we have only ever one user on an app. If maxlifetime is not checked in read, his session would never expire! What I don't get is why PHP calls gc() after read() instead of calling it before... Strange decision. For this reason I also had to do the following to improve performance.
- I delay gc() to close() so that it is executed outside the transactional and blocking read-write process. This way, pruning expired sessions does not block them from being started while the current session is used.
- Fixed time update for Oracle and SQL Server.

Commits
-------

50ec828 [HttpFoundation] implement session locking for PDO
minor #10928 [DomCrawler] Fixed the coding standards to use strict comparisons (stof)

This PR was merged into the 2.3 branch.

Discussion
----------

[DomCrawler] Fixed the coding standards to use strict comparisons

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Many places in DomCrawler are using loose comparison instead of strict comparison. I saw them while checking the whole component for DOMNode vs DOMElement usage whe working on #10927. However, I submitted this change to 2.3 instead, to ease merging between branches (applying the change only in master would likely create conflicts regularly when merging changes in DomCrawler between branches later)

Commits
-------

77b446c [DomCrawler] Fixed the coding standards to use strict comparisons
bug #10927 [DomCrawler] Changed typehints form DomNode to DomElement (stof)

This PR was merged into the 2.3-dev branch.

Discussion
----------

[DomCrawler] Changed typehints form DomNode to DomElement

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | only for people hacking the internal classes (which requires replacing the crawler too)
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #10924
| License       | MIT
| Doc PR        | n/a

Commits
-------

f416e70 [DomCrawler] Changed typehints form DomNode to DomElement