Merge branch 'branch2.2'

Conflicts:
	setup.py
	tornado/__init__.py
	tornado/test/web_test.py
	tox.ini
	website/sphinx/releases.rst

diff --cc tornado/test/web_test.py
index 96b4d662f1a1e2f18147f61f31dae5905b0909a3,5312304f54ca27a86eef61fac4f3905e45cc42df..a94fb9f51ff6ee0a6f454e052a807d7cbd3e33b0
--- 1/tornado/test/web_test.py
--- 2/tornado/test/web_test.py
+++ b/tornado/test/web_test.py
@@@ -367,20 -334,17 +367,30 @@@ class RedirectHandler(RequestHandler)
          else:
              raise Exception("didn't get permanent or status arguments")
  
 +class EmptyFlushCallbackHandler(RequestHandler):
 +    @gen.engine
 +    @asynchronous
 +    def get(self):
 +        # Ensure that the flush callback is run whether or not there
 +        # was any output.
 +        yield gen.Task(self.flush)  # "empty" flush, but writes headers
 +        yield gen.Task(self.flush)  # empty flush
 +        self.write("o")
 +        yield gen.Task(self.flush)  # flushes the "o"
 +        yield gen.Task(self.flush)  # empty flush
 +        self.finish("k")
 +
  
+ class HeaderInjectionHandler(RequestHandler):
+     def get(self):
+         try:
+             self.set_header("X-Foo", "foo\r\nX-Bar: baz")
+             raise Exception("Didn't get expected exception")
+         except ValueError, e:
+             assert "Unsafe header value" in str(e)
+             self.finish(b("ok"))
+ 
+ 
  class WebTest(AsyncHTTPTestCase, LogTrapTestCase):
      def get_app(self):
          loader = DictLoader({
@@@ -405,7 -369,7 +415,8 @@@
              url("/flow_control", FlowControlHandler),
              url("/multi_header", MultiHeaderHandler),
              url("/redirect", RedirectHandler),
 +            url("/empty_flush", EmptyFlushCallbackHandler),
+             url("/header_injection", HeaderInjectionHandler),
              ]
          return Application(urls,
                             template_loader=loader,
@@@ -499,10 -463,10 +510,14 @@@ js_embed(
          response = self.fetch("/redirect?status=307", follow_redirects=False)
          self.assertEqual(response.code, 307)
  
 +    def test_empty_flush(self):
 +        response = self.fetch("/empty_flush")
 +        self.assertEqual(response.body, b("ok"))
 +
+     def test_header_injection(self):
+         response = self.fetch("/header_injection")
+         self.assertEqual(response.body, b("ok"))
+ 
  
  class ErrorResponseTest(AsyncHTTPTestCase, LogTrapTestCase):
      def get_app(self):

diff --cc tornado/web.py
Simple merge

diff --cc tox.ini
index 0ab3581ca6526a80170868d6c9b892bb48fc02b9,7bbe791b10d2f1b6e5cb30c457890f65bf72f09f..5468c89038f80d4dc4e4822dc94b77e6d09bfc7f
--- 1/tox.ini
--- 2/tox.ini
+++ b/tox.ini
@@@ -69,19 -69,4 +69,19 @@@ commands = python -m tornado.test.runte
  # twisted under pypy takes a *very* long time.  MySQL-python builds with
  # pypy, but doesn't work.
  
 +# In python 3, opening files in text mode uses a system-dependent encoding by
 +# default.  Run the tests with "C" (ascii) and "utf-8" locales to ensure
 +# we don't have hidden dependencies on this setting.
 +[testenv:py32]
 +basepython = python3.2
 +setenv = LANG=C
 +
 +[testenv:py32-utf8]
 +basepython = python3.2
 +setenv = LANG=en_US.utf-8
 +
  # No py32-full yet: none of our dependencies currently work on python3.
- basepython = python3.3
 +
 +[testenv:py33]
 +# tox doesn't yet know "py33" by default
++basepython = python3.3

diff --cc website/sphinx/releases.rst
index 8c03063759ef469a7502bcd9f484ef83284a2df4,24aebe3e48d46714f9ee2862d86e1e73c2ecf859..fe1de2f94b35a31e79d66b1ca12dbe1ac250c673
--- 1/website/sphinx/releases.rst
--- 2/website/sphinx/releases.rst
+++ b/website/sphinx/releases.rst
@@@ -4,7 -4,7 +4,8 @@@ Release note
  .. toctree::
     :maxdepth: 2
  
 +   releases/next
+    releases/v2.2.1
     releases/v2.2.0
     releases/v2.1.1
     releases/v2.1.0