Prevented leaking the CSRF token through caching.

This is a security fix. Disclosure will follow shortly.
Fixed queries that may return unexpected results on MySQL due to typecasting.

This is a security fix; disclosure to follow shortly.
Added information on resolved security issues to release notes.
Fixed #22426 -- Added support old-style d.c.messages format.

Forward ported code from 1.5 that adds backwards compatibility with legacy message length.
See commit 9e7183073f64e541587e8dcfd8bb3ddeb47f8162 for details.

Thanks to Ofir Ovadia for the initial patch.
Added 1.6.4 release note stub.
Use the stdlib's compare_digest for constant time comparisons when available
Merge pull request #2600 from alex/builtin-constant-time-compare

Use the stdlib's compare_digest for constant time comparisons when available
Updated grammar in description of django.contrib.auth.
Various documentation typo/spelling fixes

Errors detected by Topy (https://github.com/intgr/topy), all changes
verified by hand.
Merge pull request #2602 from intgr/typofix

Various documentation typo/spelling fixes
Fixed #22486 -- Restored the ability to reverse views created using functools.partial.

Regression in 8b93b31487d6d3b0fcbbd0498991ea0db9088054.

Thanks rcoup for the report.
Used migration framework in GIS test tearDown
Added Spatialite support to the new migration framework

Refs #22451.
Fixed #22495 -- Locmem cache.add() failed with infinite timeouts

cache.add() incorrectly succeeded when there was an existing key
with an infinite (None) timeout.
Set compile messages options as class variable

Refs #18714. Same logic as options for makemessages commands.
Wrapped migrations in a transaction only on DBs with transactional DDL.
Used the same instance of atomic for entry and exit.

Since all state is maintained on the connection at this time and none in
the atomic, it doesn't matter, but it could introduce some subtle bugs
if the implementation changed in the future.
Fixed #21157 -- Fixed problems with ResolverMatch

- Fixed bug in get_callable() that caused resolve() to put a string
  in ResolverMatch.func.
- Made ResolverMatch.url_name match the actual url name (or None).
- Updated tests that used the string value in ResolverMatch.func, and
  added regression tests for this bug.
- Corrected test urls whose dummy view paths caused failures (behavior
  that was previously masked by this bug).
Renamed Transifex project from django-core to django

See also http://blog.transifex.com/post/83622601443/new-teams-management-transifex
Fixed #22499 -- Fixed a typo in an admin_views test that caused failure on Oracle.