  * The CSRF referer header is now validated against the
    :setting:`CSRF_COOKIE_DOMAIN` setting if set. See :ref:`how-csrf-works` for
    details.
  
  * The new :setting:`CSRF_TRUSTED_ORIGINS` setting provides a way to allow
    cross-origin unsafe requests (e.g. ``POST``) over HTTPS.
  
  Signals
  ^^^^^^^
  
  * ...
 
</s> remove * The CSRF referer header is now validated against the
  :setting:`CSRF_COOKIE_DOMAIN` setting if set. See :ref:`how-csrf-works` for
  details.
 </s> add * The debug view now shows details of chained exceptions on Python 3. </s> remove * The request header's name used for CSRF authentication can be customized
  with :setting:`CSRF_HEADER_NAME`.
 </s> add * Unless :attr:`HttpResponse.reason_phrase
  <django.http.HttpResponse.reason_phrase>` is explicitly set, it now is
  determined by the current value of :attr:`HttpResponse.status_code
  <django.http.HttpResponse.status_code>`. Modifying the value of
  ``status_code`` outside of the constructor will also modify the value of
  ``reason_phrase``. </s> remove CSRF
^^^^
 </s> add Requests and Responses
^^^^^^^^^^^^^^^^^^^^^^ </s> remove Requests and Responses
^^^^^^^^^^^^^^^^^^^^^^

* Unless :attr:`HttpResponse.reason_phrase
  <django.http.HttpResponse.reason_phrase>` is explicitly set, it now is
  determined by the current value of :attr:`HttpResponse.status_code
  <django.http.HttpResponse.status_code>`. Modifying the value of
  ``status_code`` outside of the constructor will also modify the value of
  ``reason_phrase``.

* The debug view now shows details of chained exceptions on Python 3.

* The default 40x error views now accept a second positional parameter, the
  exception that triggered the view.

* View error handlers now support
  :class:`~django.template.response.TemplateResponse`, commonly used with
  class-based views.

* Exceptions raised by the ``render()`` method are now passed to the
  ``process_exception()`` method of each middleware.

* Request middleware can now set :attr:`HttpRequest.urlconf
  <django.http.HttpRequest.urlconf>` to ``None`` to revert any changes made
  by previous middleware and return to using the :setting:`ROOT_URLCONF`.

* The :setting:`DISALLOWED_USER_AGENTS` check in
  :class:`~django.middleware.common.CommonMiddleware` now raises a
  :class:`~django.core.exceptions.PermissionDenied` exception as opposed to
  returning an :class:`~django.http.HttpResponseForbidden` so that
  :data:`~django.conf.urls.handler403` is invoked.

* Added :meth:`HttpRequest.get_port() <django.http.HttpRequest.get_port>` to
  fetch the originating port of the request.

* Added the ``json_dumps_params`` parameter to
  :class:`~django.http.JsonResponse` to allow passing keyword arguments to the
  ``json.dumps()`` call used to generate the response.

* The :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` now
  ignores 404s when the referer is equal to the requested URL. To circumvent
  the empty referer check already implemented, some Web bots set the referer to
  the requested URL.

 </s> add  </s> remove   cells has changed from ``(None)`` (or its translated equivalent) to ``-``.
 </s> add   cells has changed from ``(None)`` (or its translated equivalent) to ``-`` (a
  dash).
* The default 40x error views now accept a second positional parameter, the
  exception that triggered the view.

* View error handlers now support
  :class:`~django.template.response.TemplateResponse`, commonly used with
  class-based views.

* Exceptions raised by the ``render()`` method are now passed to the
  ``process_exception()`` method of each middleware.

* Request middleware can now set :attr:`HttpRequest.urlconf
  <django.http.HttpRequest.urlconf>` to ``None`` to revert any changes made
  by previous middleware and return to using the :setting:`ROOT_URLCONF`.

* The :setting:`DISALLOWED_USER_AGENTS` check in
  :class:`~django.middleware.common.CommonMiddleware` now raises a
  :class:`~django.core.exceptions.PermissionDenied` exception as opposed to
  returning an :class:`~django.http.HttpResponseForbidden` so that
  :data:`~django.conf.urls.handler403` is invoked.

* Added :meth:`HttpRequest.get_port() <django.http.HttpRequest.get_port>` to
  fetch the originating port of the request.

* Added the ``json_dumps_params`` parameter to
  :class:`~django.http.JsonResponse` to allow passing keyword arguments to the
  ``json.dumps()`` call used to generate the response.

* The :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` now
  ignores 404s when the referer is equal to the requested URL. To circumvent
  the empty referer check already implemented, some Web bots set the referer to
  the requested URL.
  * The CSRF referer header is now validated against the
    :setting:`CSRF_COOKIE_DOMAIN` setting if set. See :ref:`how-csrf-works` for
    details.
  
* The default 40x error views now accept a second positional parameter, the
  exception that triggered the view.

* View error handlers now support
  :class:`~django.template.response.TemplateResponse`, commonly used with
  class-based views.

* Exceptions raised by the ``render()`` method are now passed to the
  ``process_exception()`` method of each middleware.

* Request middleware can now set :attr:`HttpRequest.urlconf
  <django.http.HttpRequest.urlconf>` to ``None`` to revert any changes made
  by previous middleware and return to using the :setting:`ROOT_URLCONF`.

* The :setting:`DISALLOWED_USER_AGENTS` check in
  :class:`~django.middleware.common.CommonMiddleware` now raises a
  :class:`~django.core.exceptions.PermissionDenied` exception as opposed to
  returning an :class:`~django.http.HttpResponseForbidden` so that
  :data:`~django.conf.urls.handler403` is invoked.

* Added :meth:`HttpRequest.get_port() <django.http.HttpRequest.get_port>` to
  fetch the originating port of the request.

* Added the ``json_dumps_params`` parameter to
  :class:`~django.http.JsonResponse` to allow passing keyword arguments to the
  ``json.dumps()`` call used to generate the response.

* The :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` now
  ignores 404s when the referer is equal to the requested URL. To circumvent
  the empty referer check already implemented, some Web bots set the referer to
  the requested URL.
* The default 40x error views now accept a second positional parameter, the
  exception that triggered the view.

* View error handlers now support
  :class:`~django.template.response.TemplateResponse`, commonly used with
  class-based views.

* Exceptions raised by the ``render()`` method are now passed to the
  ``process_exception()`` method of each middleware.

* Request middleware can now set :attr:`HttpRequest.urlconf
  <django.http.HttpRequest.urlconf>` to ``None`` to revert any changes made
  by previous middleware and return to using the :setting:`ROOT_URLCONF`.

* The :setting:`DISALLOWED_USER_AGENTS` check in
  :class:`~django.middleware.common.CommonMiddleware` now raises a
  :class:`~django.core.exceptions.PermissionDenied` exception as opposed to
  returning an :class:`~django.http.HttpResponseForbidden` so that
  :data:`~django.conf.urls.handler403` is invoked.

* Added :meth:`HttpRequest.get_port() <django.http.HttpRequest.get_port>` to
  fetch the originating port of the request.

* Added the ``json_dumps_params`` parameter to
  :class:`~django.http.JsonResponse` to allow passing keyword arguments to the
  ``json.dumps()`` call used to generate the response.

* The :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` now
  ignores 404s when the referer is equal to the requested URL. To circumvent
  the empty referer check already implemented, some Web bots set the referer to
  the requested URL.
  
  Signals
  ^^^^^^^
  
  * ...
keep keep keep keep replace replace keep keep keep keep keep
 Alphabetized a few sections in the 1.9 release notes + made a few tweaks. 
docs/releases/1.9.txt