Thank-you Katie Miller and Ben Sturmfels for the initial draft,
as well as Russ and Carl for the reviews.

Thanks waldeinburg for the report.

Refs #19206.

Since 1.5 is feature-frozen, we need them to document new features.

Thanks daniel at blogg.se for the report and Aymeric Augustin for
his assistance on the patch.

If the current sessions user was logged in via a remote user backend log out
the user if REMOTE_USER header not available - otherwise leave it to other auth
middleware to install the AnonymousUser.

Thanks to Sylvain Bouchard for the initial patch and ticket maintenance.

Refs #19061, #19057.

Thanks mitar for the report.

Thanks Graham Dumpleton for the patch.

Thanks bernardofontes for the report.

Thanks to okke@formsma.nl for the report, and carmandrew@gmail.com for the tests.

Thanks delormemarco@gmail.com for the report.

Thanks void.

Thanks Russell for the report.

Refs #19201.

loads has no way to tell if it should provide text or bytes to the
serializer; bytes are more reasonnable for a serialized representation,
and are the only option for pickled data.

dumps can perform conversions on the value it receives from the
serializer; but for consistency it seems better to require bytes too.

The current code would cause an exception when loading pickled session
data. See next commit.

Also fixed a bug when checking for compressed data.

There was a potential data-loss issue involved -- when clearing
instance's m2m assignments it was possible some other instance's
m2m data was deleted instead.

This commit also improved None handling for to_field cases.

Thanks stumbles for the patch.

Thanks lrekucki for the report.

* Prevented stale session files from being loaded
* Added removal of stale session files in django-admin.py clearsessions

Thanks ej for the report, crodjer and Elvard for their inputs.

These tests are expected to fail for the file session backend because it
doesn't handle expiry properly. They didn't because of an error in the
test setup sequence.

Refs #19200, #18194.

This change allows for cleaner tests: we can test the exact output.

Refs #18194: this change makes it possible to compute session expiry
dates at times other than when the session is saved.

Fixed #18458: the existence of the `modification` kwarg implies that you
must pass it to get_expiry_age/date if you call these functions outside
of a short request - response cycle (the intended use case).

Thanks to Berker Peksag for the patch.

Also did a little bit of cleanup.

This removes a dependency of 'core' on 'contrib'.

The Query.select and Query.select_fields were collapsed into one list
because the attributes had to be always in sync. Now that they are in
one attribute it is impossible to edit them out of sync.

Similar collapse was done for Query.related_select_cols and
Query.related_select_fields.