Merge branch '2.8' into 3.4

* 2.8:
  do not mock the session in token storage tests
  Add Occitan plural rule
  Fix security/* cross-dependencies
  Disallow illegal characters like "." in session.name
  fix rounding from string

Tests/Extension/Core/DataTransformer/MoneyToLocalizedStringTransformerTest.php

@@ -78,6 +78,16 @@ public function testFloatToIntConversionMismatchOnReversTransform()
         $transformer = new MoneyToLocalizedStringTransformer(null, null, null, 100);
         IntlTestHelper::requireFullIntl($this, false);
         \Locale::setDefault('de_AT');
+
         $this->assertSame(3655, (int) $transformer->reverseTransform('36,55'));
     }
+
+    public function testFloatToIntConversionMismatchOnTransform()
+    {
+        $transformer = new MoneyToLocalizedStringTransformer(null, null, MoneyToLocalizedStringTransformer::ROUND_DOWN, 100);
+        IntlTestHelper::requireFullIntl($this, false);
+        \Locale::setDefault('de_AT');
+
+        $this->assertSame('10,20', $transformer->transform(1020));
+    }
 }

composer.json

@@ -31,7 +31,7 @@
         "symfony/config": "~2.7|~3.0|~4.0",
         "symfony/http-foundation": "~2.8|~3.0|~4.0",
         "symfony/http-kernel": "^3.3.5|~4.0",
-        "symfony/security-csrf": "~2.8|~3.0|~4.0",
+        "symfony/security-csrf": "^2.8.31|^3.3.13|~4.0",
         "symfony/translation": "~2.8|~3.0|~4.0",
         "symfony/var-dumper": "~3.3.11|~3.4|~4.0",
         "symfony/console": "~3.4|~4.0"