  
  CSRF
  ^^^^
  
  * The request header's name used for CSRF authentication can be customized
    with :setting:`CSRF_HEADER_NAME`.
  
  * The CSRF referer header is now validated against the
    :setting:`CSRF_COOKIE_DOMAIN` setting if set. See :ref:`how-csrf-works` for
    details.
  
 
</s> remove * The CSRF referer header is now validated against the
  :setting:`CSRF_COOKIE_DOMAIN` setting if set. See :ref:`how-csrf-works` for
  details.
 </s> add * The debug view now shows details of chained exceptions on Python 3. </s> remove CSRF
^^^^
 </s> add Requests and Responses
^^^^^^^^^^^^^^^^^^^^^^ </s> remove * The new :setting:`CSRF_TRUSTED_ORIGINS` setting provides a way to allow
  cross-origin unsafe requests (e.g. ``POST``) over HTTPS.
 </s> add * The default 40x error views now accept a second positional parameter, the
  exception that triggered the view.

* View error handlers now support
  :class:`~django.template.response.TemplateResponse`, commonly used with
  class-based views.

* Exceptions raised by the ``render()`` method are now passed to the
  ``process_exception()`` method of each middleware.

* Request middleware can now set :attr:`HttpRequest.urlconf
  <django.http.HttpRequest.urlconf>` to ``None`` to revert any changes made
  by previous middleware and return to using the :setting:`ROOT_URLCONF`.

* The :setting:`DISALLOWED_USER_AGENTS` check in
  :class:`~django.middleware.common.CommonMiddleware` now raises a
  :class:`~django.core.exceptions.PermissionDenied` exception as opposed to
  returning an :class:`~django.http.HttpResponseForbidden` so that
  :data:`~django.conf.urls.handler403` is invoked.

* Added :meth:`HttpRequest.get_port() <django.http.HttpRequest.get_port>` to
  fetch the originating port of the request.

* Added the ``json_dumps_params`` parameter to
  :class:`~django.http.JsonResponse` to allow passing keyword arguments to the
  ``json.dumps()`` call used to generate the response.

* The :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` now
  ignores 404s when the referer is equal to the requested URL. To circumvent
  the empty referer check already implemented, some Web bots set the referer to
  the requested URL. </s> remove Requests and Responses
^^^^^^^^^^^^^^^^^^^^^^

* Unless :attr:`HttpResponse.reason_phrase
  <django.http.HttpResponse.reason_phrase>` is explicitly set, it now is
  determined by the current value of :attr:`HttpResponse.status_code
  <django.http.HttpResponse.status_code>`. Modifying the value of
  ``status_code`` outside of the constructor will also modify the value of
  ``reason_phrase``.

* The debug view now shows details of chained exceptions on Python 3.

* The default 40x error views now accept a second positional parameter, the
  exception that triggered the view.

* View error handlers now support
  :class:`~django.template.response.TemplateResponse`, commonly used with
  class-based views.

* Exceptions raised by the ``render()`` method are now passed to the
  ``process_exception()`` method of each middleware.

* Request middleware can now set :attr:`HttpRequest.urlconf
  <django.http.HttpRequest.urlconf>` to ``None`` to revert any changes made
  by previous middleware and return to using the :setting:`ROOT_URLCONF`.

* The :setting:`DISALLOWED_USER_AGENTS` check in
  :class:`~django.middleware.common.CommonMiddleware` now raises a
  :class:`~django.core.exceptions.PermissionDenied` exception as opposed to
  returning an :class:`~django.http.HttpResponseForbidden` so that
  :data:`~django.conf.urls.handler403` is invoked.

* Added :meth:`HttpRequest.get_port() <django.http.HttpRequest.get_port>` to
  fetch the originating port of the request.

* Added the ``json_dumps_params`` parameter to
  :class:`~django.http.JsonResponse` to allow passing keyword arguments to the
  ``json.dumps()`` call used to generate the response.

* The :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` now
  ignores 404s when the referer is equal to the requested URL. To circumvent
  the empty referer check already implemented, some Web bots set the referer to
  the requested URL.

 </s> add  </s> remove Database backends
^^^^^^^^^^^^^^^^^

* The PostgreSQL backend (``django.db.backends.postgresql_psycopg2``) is also
  available as ``django.db.backends.postgresql``. The old name will continue to
  be available for backwards compatibility.

 </s> add 
* Unless :attr:`HttpResponse.reason_phrase
  <django.http.HttpResponse.reason_phrase>` is explicitly set, it now is
  determined by the current value of :attr:`HttpResponse.status_code
  <django.http.HttpResponse.status_code>`. Modifying the value of
  ``status_code`` outside of the constructor will also modify the value of
  ``reason_phrase``.
  
  CSRF
  ^^^^
  
* Unless :attr:`HttpResponse.reason_phrase
  <django.http.HttpResponse.reason_phrase>` is explicitly set, it now is
  determined by the current value of :attr:`HttpResponse.status_code
  <django.http.HttpResponse.status_code>`. Modifying the value of
  ``status_code`` outside of the constructor will also modify the value of
  ``reason_phrase``.
* Unless :attr:`HttpResponse.reason_phrase
  <django.http.HttpResponse.reason_phrase>` is explicitly set, it now is
  determined by the current value of :attr:`HttpResponse.status_code
  <django.http.HttpResponse.status_code>`. Modifying the value of
  ``status_code`` outside of the constructor will also modify the value of
  ``reason_phrase``.
  
  * The CSRF referer header is now validated against the
    :setting:`CSRF_COOKIE_DOMAIN` setting if set. See :ref:`how-csrf-works` for
    details.
  
keep keep keep keep replace replace keep keep keep keep keep
 Alphabetized a few sections in the 1.9 release notes + made a few tweaks. 
docs/releases/1.9.txt