* Fix #3910 - Require OTP authentication to disable 2FA. Also, remove ability
to generate new OTP backup codes *after* initial backup codes were handed
out during activation

* Restore recovery code re-generation

* Improve display of some 2FA elements

* Add overview of active sessions

* Better display of browser/platform name

* Improve how browser information is stored and displayed for sessions overview

* Fix test

* Fix #2347 - Bind web UI access token to session

When you logout, session also destroys the access token, so it's no longer
valid. If access token is destroyed some other way, the session is also
destroyed, requiring a re-login.

Fix #1681 - Add scheduler to remove revoked access tokens and grants

* Fix test

* Rename "Credentials" page to "Security" for clarity

* Change "security" icon from cog to lock

Also domain_block fabricator now sets unique domains

* more free pgconfig for streaming by .env

* fix wrong default values

* database.yml read ENV as same as streaming server

* Add overview of active sessions

* Better display of browser/platform name

* Improve how browser information is stored and displayed for sessions overview

* Fix test

Setting ASSET_HOST to `http://0.0.0.0:8080` makes urls in manifest.json to
be invalid, e.g. `http://0.0.0.0:8080/packs/application.js`.

Anyway, we don't need set this on build:development because assets would
be delivered from same origin in development (and w/o dev-server).

Webpack seems to fail to import `react-intl/locale-data/*.js` if those
files has been proceed by babel, and this also breaks applying our translation.

Note that this won't be a problem on English locale, because react-intl
includes it as default and works fine without manually added locale-data.
Also this issue seems to only occurs on production build, but I'm not sure
about reason.

* Remove unused column_collapsable.js
* Remove old styles
* Extract `> div`  style to independent class

ref https://tc39.github.io/proposal-decorators/

* Fix errorMiddleware

* Add "eslint-disable-line no-unused-vars"

* feat: Revocable sessions

* fix: Tests using sign_in

* feat: Configuration entry for the maximum number of session activations

* Add Russian translation (ru)

* Fix a missing comma

* Fix the wording for better consistency

* Update Russian translation

* Arrange Russian setting alphabetically

* Fix syntax error

* Update Russian translation

* Fix formatting error

* Update Russian translation

* Update Russian translation

* Update ru.jsx

* Fix syntax error

* Remove two_factor_auth.warning (appears obsolete)

* Add missing strings in ru.yml

A lot of new strings translated, especially for the newly added admin section

* Fix translation consistency

* Update Russian translation

* Update Russian translation (pluralizations)

* Update Russian translation

* Update Russian translation

* Update Russian translation (pin)

* Update Russian translation (account deletion)

* Fix extra line

as mentioned by ElvenSpellmaker here: https://github.com/rvm/rvm/issues/4068

Adds a workaround for the issue mentioned by @abcang here: https://github.com/tootsuite/mastodon/pull/3897#issuecomment-310436668 and makes sure that we're using the stable installer to install the stable version.

* Introduce domains method to Account relation

Account had followers_domains method, which was excessively specific.
Let relation of Account have domains method instead.

* Move follow_mapping in Account to AccountInteractions

* Introduce shared examples for AccountAvatar inclusion

* Cover Account more

Just some adjustements

https://github.com/travis-ci/travis-ci/issues/7941#issuecomment-310320597

* Fix regression from #3842

Simplify the query by omitting all direct statuses. Private statuses
are allowed because they are from accounts we are following (so
by definition)

Resolves #3887 (alternative)

* Adjust test

(This patch has been merged as bugfix and reverted, but still valuable as
improvement)

Previously, we've attached IntersectionObserver twice for boosted statuses:
wrapper Status and wrapped Status. but wrapped Status don't need to manage
intersection and visibility by itself, because it's a part of wrapper Status.

* Revert "Bump version to 1.4.4"

This reverts commit 1585b0c6cc.

* Revert "Fix conversations (fixes #3869) (#3870)"

This reverts commit 15b43f555d.

* Revert "Fix streaming server. Redis connection subscribe for each channel. (#3828)"

This reverts commit d8ec832806.

* Revert "Filter direct statuses in Status.as_home_timeline (#3842)"

This reverts commit bab5a18232.

* Revert "Fix RemoteFollow behavior (#3868)"

This reverts commit a20cf3b64e.

* Revert "Update fabricator for MediaAttachment to attach a file according to type (#3862)"

This reverts commit 356df7ae6b.

* Revert "Upgrade React Router (#3677)"

This reverts commit 8f03fdce7f.

* Revert "Do not call setState from unmounted component (#3853)"

This reverts commit 1fc6cb4997.

* Revert "Replace TextIconButton for SensitiveButton to IconButton (#3759)"

This reverts commit eb832e88f4.

* Revert "Fix RTL detection on Ruby side (#3867)"

This reverts commit b16b69350e.

* Revert "i18n: Fixed typo in Polish translation (#3864)"

This reverts commit da6fa029f6.

* Revert "Don't attach IntersectionObserver for wrapped statuses (#3863)"

This reverts commit 94ad0706f5.

* Actually create conversations given explicit URIs

* Try to get the parent toot in before validation, to avoid creating a new conversation