Use atomic instead of commit_on_success if available

commit_on_success is deprecated as of Django 1.6, and will be removed in
Django 1.8.
Handle Django's new password reset links

Django 1.6 changed the encoding of the user's primary key. See the
comment in oscar/app.py for an overview.

This commit also reverts the URL syntax for all password reset links to
the style in the Django documentation. It is slightly more permissive,
but shouldn't cause any issues.

This commit also changes a bug in the get_password_reset_url function
where it would ignore the passed token generator and always use the
default one.

Fixes #1203
Switch tests to use JSONSerialiser for sessions

Oscar should support it now, so it makes sense to run the tests with the
less forgiving JSON serialiser.
Remove SEND_BROKEN_LINKS_EMAILS setting

It's been removed in Django 1.6. And as it was set to False in the code,
it can safely be removed as well.
Add Django compatibility to release notes
Merge branch 'fix/django16compat'