[IMP] web: allow rpc options to be passed to Model.query() calls
[IMP] point_of_sale: automatically update partners data when they are modified
[FIX] point_of_sale: the order reference used the session sequence number wich was not unique accross sessions on different point_of_sales.

Now we are using the session id which is unique, but is less understandable
[FIX] security: ir.config_parameter should not be readable by externals
[FIX] security: externals should be able to read attachements

without having the rights to read ir.config_parameter
[FIX] website_forum: fixed setting an answer as valid / invalid. The change
in the behavior of browse records due to the new API introduced a wrong
behavior, now fixed.
[FIX] website_forum: issue in biography (unnecessary tags added by editor) + menu control (Users / My Profile)
[FIX] security: res.groups should be readable by admins only
[FIX] website_forum: second part of the fix introduced at revision fd5516ade8409bcec2eb60ea9337769a6c3307f6. Wrong commit was added to 8.0, missing code cleaning.
[IMP]Website_Quote: Opens quotations menu after installation
[FIX] crm_lead: add utm in the group by from opportunities search view
[FIX] security: remove read access on company critical fields
[IMP] point_of_sale: prevent multicompany configuration issues

If the pos.config is not properly configured for multicompany (e.g. using location belonging to another company), launching a session with this config may fail (access rights).
This prevents to configure an incorrect point of sale in the first place.
[FIX] security: disallow read on ir.sequence for externals
[FIX] point_of_sale: incorrect sequences for orders

A new ir.sequence is generated at pos.config creation for the orders. However it was not used as the type was not set. The fallback was done on the general sequence.
In addition to the sequences being shared, it was not possible to create a pos.order in multicompany (no sequence found for user company, name was null).
Same issue for the pos.order.line.
This patch generates correctly pos.order and pos.order.line sequences at pos.config creation.

Instead of using the pos.config sequence to generate session number (not what this field was intended to), use the existing sequence for pos.session.
Remove company_id value on default pos.session sequence to make sure it's shared between companies and correctly set the prefix.
[FIX] account: name of bank statement is not required

At the confirmation of a bank statement, the name may not be set (e.g. generated by point of sale). This field is not requred so make a fallack on the statement line (which is required).
[IMP] doc/howtos/backend: improve views, fix workflow
[FIX] email_template: security, email_template no rights for externals
[FIX] resource: security, resource not readable by externals
[IMP] account: Invoice analysis, filter year by default

For companies having a lot of invoice, not applying the year filter leads to a long reponse time