Merge branch 'weave-security-fix' into master.

Reviewed offline because it was marked CVE.
DOC: add 0.12.1 release notes.
TST: increase test coverage of stats module.
BUG: fix incorrect output from stats.tsem.  Add tests for trimmed stats funcs.
TST: fix non-running tests for stats.itemfreq.

TestCase subclasses don't work with test generators.
TST: fix non-running test for stats.mannwhitneyu.
Merge pull request #2913 from rgommers/stats-coverage

stats.py fixes and test coverage
ENH: prefer XDG_CACHE_HOME for weave catalog cache
Merge pull request #2982 from juliantaylor/weave-xdg

ENH: prefer XDG_CACHE_HOME for weave catalog cache
DOC: clarify the docstring of stats.randint.  Also fix the 4th moment.
ENH: moments for the zipf distribution
Merge branch 'pr/2904' into master.

See https://github.com/scipy/scipy/pull/2904
Merge pull request #2970 from pv/quad-docc

DOC: fix up quad() and show_options() docstrings
BUG: BPoly: fix the derivative
Fix a minor typo
WIP ENH: Add "limit" argument to dijkstra
Merge pull request #2985 from thenovices/fix-typo

Fix a minor typo
BUG: interpolate/_ppoly: minor cleanups according to review comments
TST: remove all docstrings from test functions for stats.morestats
ENH: interpolate: add extrapolate attribute to PPoly and BPoly