use utils-merge module to mixin object properties
use escape-html module to escape html

Another util bites the dust.
remove unused require
change res.locals to a plain js object.

Anyone who wants something fancier should use modules.

- fixes annoyance with not being able to set 'name' property on locals
Merge pull request #1908 from visionmedia/locals-object

change res.locals to a plain js object.
update range parser to 1.0.0

- License

see #1912
update node-fresh
update send to 0.2.0
update cookie-signature to 1.0.3

Fix for timing attack
update merge-descriptors
remove app.router and refactor middleware processing

This is an overhaul of middleware processing, Router and Route. Connect is no
longer used to process the middleware stack. This functionality has been
split into two parts: middleware stack and default error response.

The entry point for request processing is the `app.handle` method. It
sets up the default error response handle (to run in the event of no
other error handler) and then triggers the app router (instance of
Router) to handle the request.

The app router `handle` function contains the middleware dispatch layer
previously in the connect codebase. This layer handle the logic for
dispatching `.use` calls (stripping paths if needed). The app contains a
base router `app._router`. New routes can be created and `.use`d on this
router to organize routes into files.

Routers now have the following methods `.use`, `.all`, `.param` which
are all public.

Additionally, Routers have a `.route(path)` method which returns a new
instance of Route for the requested path. Route(s) are isolated
middleware stacks and contain methods for the HTTP verbs as well as an
`.all` method to act similar to middleware. These methods are chainable
to easily describe requirements for a route.

  var route = Router.route('/foo'); // or 'app.route('/foo')'

  route
  .all(auth)
  .get(function(...) {})
  .all(more_checks)
  .post(function(...) {})

Any Route and Router methods which accept handlers also accept error
(arity 4) handlers which will also behave as expected.

Finally, the `app.router` getter has been removed. Middleware and
handlers are run IN THE ORDER they are seen in the file. This means that
code which injected the `app.router` and then added error handlers (or
other middleware) will need to be updated to move those handlers after
any requests added on the app object. The examples have been updated
accordingly. This is the largest breaking change to codebases in this
commit.
res.location: remove resolving relative urls

closes #1804

this is an unnecessary maintenance burden (see the number of removed
tests), especially when supporting mounting. browsers handle relative
locations, and so should all clients.

a regression could be absolute locations on a mounted app, but 1. we
can fix that later when someone complains and 2) code-smell
test app.router: ignore connect method

so tests pass in 0.11. 0.11 client seems to throw errors more often, so
this is not an issue with express or node’s servers.
update history
update node-fresh
move `connect.query()` into our repo
use local copy of parseUrl
remove last pieces of connect dependency

- copy over patch.js to shim ServerResponse
- bundle `static` middleware
remove ServerResonse.headerSent monkey patch

node.js ServerResponse contains a headersSent field. Use that instead of
our patched misnamed version.
remove support for node 0.8