* upstream: (21 commits)
  Fixes #1643: Added default value for `Captcha::options`
  Fixes #1654: Fixed the issue that a new message source object is generated for every new message being translated
  Allow dash char in ActionColumn’s button names.
  Added SecurityTest.
  fixed functional test when enablePrettyUrl is false.
  fixed composer.json
  minor doc fix.
  Fixes #1634: Use masked CSRF tokens to prevent BREACH exploits
  Use better random CSRF token.
  GII unique indexes avoid autoIncrement columns
  updated debug retry params.
  Added sleep().
  Added unit test for ActiveRecord::updateAttributes().
  Fixes #1641: Added `BaseActiveRecord::updateAttributes()`
  Fixed #1504: Debug toolbar isn't loaded successfully in some environments when xdebug is enabled
  Mongo README.md updated.
  Fixes #1611: Added `BaseActiveRecord::markAttributeDirty()`
  Number validator was missing
  Fixes #1638: prevent table names from being enclosed within curly brackets twice.
  Unique indexes rules for single columns into array
  ...