Python 3.12 deprecates the utcnow and utcfromtimestamp methods and
discourages the use of naive datetimes to represent UTC. This was
previously the main way that Tornado used datetimes (since it was
the only option available in Python 2 before the introduction
of datetime.timezone.utc in Python 3.2).

- httpclient_test: Test-only change to test that both kinds of datetimes
  are supported in If-Modified-Since (this just calls
  httputil.format_timestamp)
- httputil: No functional changes, but format_timestamp's
  support for both naive and aware datetimes is now tested.
- locale: format_timestamp now supports aware datetimes (in
  addition to the existing support for naive datetimes).
- web: Cookie expirations internally use aware datetimes.
  StaticFileHandler.get_modified_time now supports both and the
  standard implementation returns aware.

It feels fragile that "naive" and "aware" datetimes are not distinct
types but subject to data-dependent behavior. This change uses
"aware" datetimes throughout Tornado, but some operations (comparisons
and subtraction) fail with mixed datetime types and if I missed any
in this change may cause errors if naive datetimes were used (where
previously naive datetimes would have been required). But that's
apparently the API we have to work with.

Under some configurations the default_filename redirect could be exploited
to redirect to an attacker-controlled site. This change refuses to redirect
to URLs that could be misinterpreted.

A test case for the specific vulnerable configuration will follow after the
patch has been available.

This was an unintended feature that got broken in #3224. Bring it back
for now but deprecate it for future cleanup.

Fixes #3252

This makes the auto-import functionality compatible with mypy
and other typing-based tools such as autocomplete functionality.
Excluding these imports from static typing feels like a premature
optimization and made it much less appealing to make use of the
auto-imports.

This may slow down type checking of applications that use Tornado by
a little, since the type checker must now process all of Tornado and
not only the subset that was imported. However, the increasing use
of long-lived daemons for type checkers should mitigate this cost.

This makes it possible to use the __Host- cookie prefix for increased
security

Add a README to the demos directory with a brief description of each,
and a warning about the usage of not-yet-released features.

Fixes #3236

In some cases it is now required to pass matching values for
samesite and secure as when the cookie was set.

clear_all_cookies is now deprecated because the name of a cookie
is no longer reliably sufficient to clear it.

Fixes #2911

Multiple arguments needed special cases anyway, so it's better to
just be explicit about what's supported.

set_signed_cookie still uses kwarg forwarding since we don't need
to worry about the special cases at this level and using
explicit arguments would involve duplicating defaults in multiple
places.

This more precisely states the kind of security that is provided, and
avoids confusion with the use of the word "secure" as a standard
cookie attribute and prefix.

A getattr hook in the top-level "tornado" package now imports submodules
automatically, eliminating the need to explicitly reference multiple submodules
in imports

In particular, this makes it easier to use reuse_port.

Adapt for Python 3.10 deprecation changes by using asyncio.run
instead of IOLoop.start throughout (except for TCPServer multi-process
docs).

Demos have all been changed but I haven't tested all of them.

Our version of sphinx isn't resolving this annotation correctly.

Introduced in #3014 because CI was broken when it was submitted.

`Accept-Language: en-US; q=-1` is not allowed. ignore it.
Even better would be to raise HTTP 400 Bad Request.

`Accept-Language: en-US; q=0, de-DE; q=0.5` means that english MUST not
be selected.

HTTP allows OWS between parameters:
`Accept-Language: de-DE; q=0.1, en-US; q=0.2`

Type-hint stream_request_body so that the type of stream_request_body(cls) is the same as the type of cls.

On Python 3, super does not need to be called with arguments where as on
Python 2, super needs to be called with a class object and an instance.

This commit updates the super usage using automated regex-based search
and replace. After the automated changes were made, each change was
individually checked before committing.

This required some minor code changes, mainly some adjustments in tests
(which are now analyzed more thoroughly in spite of being mostly
unannotated), and some changes to placement of type:ignore comments.

This requires moving some noqa comments due to 3.8's changes to the
ast module.

Addresses #2776.

This function is called on more than just 304 responses; it’s
important to permit the Allow header on 204 responses.  Also, the
relevant RFCs have changed significantly.

Fixes #2726.
Signed-off-by: NAnders Kaseorg <andersk@mit.edu>

"Implicit-optional" mode is on by default, but that default is intended to change in the indefinite future (python/peps#689, python/typing#275). Go ahead and change to the future explicit use of Optional.

The "provisional" typing module in 3.5.2 is kind of broken/incomplete
so we need to use more forward references to avoid confusing it. The
significance of this version in particular is that it was the one
included in ubuntu 16.04.

Fixes #2604

* Serve full file while range negative past start.

Fix issue #2521.

* Return 416 while range end less than start.

When range end less than start, the content length will be negative and
HTTPOutputError will be raised.