Merge branch 'master' of https://github.com/tornadoweb/tornado

diff --cc docs/guide/security.rst
Simple merge

diff --cc docs/releases/next.rst
index 930a118f073541cda3ef275dfb943a9848c6612f,28353b4969fa935097d3f8e4338f4ad16991a0d5..30b70e6f011f1a9429df3431a71a9d7b66fdf3fe
--- 1/docs/releases/next.rst
--- 2/docs/releases/next.rst
+++ b/docs/releases/next.rst
@@@ -56,9 -114,16 +114,19 @@@ Backwards-compatibility note
  * Passing ``secure=False`` or ``httponly=False`` to
    `.RequestHandler.set_cookie` now works as expected (previously only the
    presence of the argument was considered and its value was ignored).
+ * Parsing of the ``If-None-Match`` header now follows the RFC and supports
+   weak validators.
+ * `.RequestHandler.get_arguments` now requires that its ``strip`` argument
+   be of type bool. This helps prevent errors caused by the slightly dissimilar
+   interfaces between the singular and plural methods.
+ * Errors raised in ``_handle_request_exception`` are now logged more reliably.
+ * `.RequestHandler.redirect` now works correctly when called from a handler
+   whose path begins with two slashes.
+ * Passing messages containing ``%`` characters to `tornado.web.HTTPError`
+   no longer causes broken error messages.
 +* Key versioning support for cookie signing. ``cookie_secret`` application
 +  setting can now contain a dict of valid keys with version as key. The
 +  current signing key then must be specified via ``key_version`` setting.
  
  `tornado.websocket`
  ~~~~~~~~~~~~~~~~~~~

diff --cc tornado/test/web_test.py
Simple merge

diff --cc tornado/web.py
Simple merge