[FIX] account_followup: avoid crashing when a move line has no ref
[FIX] portal_sale: browse data for payment acquirer form with superuser ID

The payment form needs to be rendered for non-employee
users, and may require accessing extra financial data
not available for those users.
[FIX] procurement, stock: forward port of bug fix 3609ba10f2d00a608d8f32334ae1b9a25b34f037
[FIX] account.invoice: payments can never be shown to portal users, but residual might be needed

The residual amount is typically needed to render the
online payment forms (payment acquirers).

Payments on the other hand rely on account.move.line,
something that portal users should never be allowed to read.
Removing the field from the view by setting a model-level
group permission ensures they will not see an error.
[FIX] mail, email_template: prevent user from creating
templates in the templat_idm2o field on the wizard; prevent users from
creating models in the model_id m2o field on the template form view.
[FIX] gamification: prohibitive record rule processing with many users/goals

Due to the multi-company record rule on gamification.goal,
each access to the Goals menu and each opening of the
Messaging menu (thus calling get_serialised_gamification_summary())
is extremely slow (with several thousands goals/users).

Adding auto_join to the user_id FK on goals makes it much
faster. However it causes crashes when reading the table
because the _order of gamification.goal uses `create_date`,
which becomes ambiguous after the auto_join with res_users.

Solving this can be done by re-implementing _read_flat()
in the ORM using the internal Query object, as in search(),
which takes care of fully-qualifying all column names.

Until this is fixed, a simple workaround is to use
start_date in the _order instead of collision-prone `create_date`.
[FIX] export: add the context in the export

In some cases, the data dispalyed in a list depends on the context
This context needs to be passed to the export method, so the exported data reflects correctly the data from the list view
[FIX] context_timestamp MUST return a "timezone aware" timestamp
[IMP] calculating nextcall datetime of a cron SHOULD use the cron's user
[FIX] base: revert 19e401a for title on res.partner form

The title of the partner is restricted with a context that will change in the onchange_type. Having twice the same field will not work well.
Remove the invisible attribute as the domain is handled by the domain.
[FIX] purchase: add purchase_order_count in kanban for purchase users only

No need to set account.group_account_manager for the field supplier_invoice_count, as account.group_account_manager implies account.group_account_user
[FIX] mail: when having only mail installed, do not show any 'share with my followers' compose box. This comes only with hr, for the inbox. This was probably forgotten when updating the mailboxes hr-goal and hr-related gamification / chatter stuff.
[FIX] mail: posting on the user should be redirect to its partner, not nowhere.
[FIX] mass_mailing: fixed label of ab testing not displayed in mailing
form view when not using campaigns; however this option should be displayed.
[CLEAN] mail_message: removed an unused import
[FIX] portal_sale: remove un-necessary access rights, improve rules

Portal access rights need to be associated with
security rules, or not granted at all, as soon
as they grant access to non-trivial data.
[FIX] portal_sale: remove more access rights, add pricelist access

Pricelist access is necessary for being able to read
the unit price of sale order lines, and does not
pose major security risks, as it does not permit
reading the actual pricelist definition.
[MERGE] Forward-port 7.0 up to 23cffab
[MERGE] Forward-port saas-3 up to b9275da
[MERGE] Forward-port saas-4 up to 2694ed1