Added support for custom CSRF cookie names

Merge the changes in 3.3.x back to master.

Instead of hardcoding the CSRF cookie name, the value is passed to the template as a context variable, rendered as a JavaScript variable, and read by csrf.js.

Fixes #4048

* Made sure the OrderingFilter relies on Field.verbose_name.

* Marked OrderingFilter's order labels for translation.

# Conflicts:
#	docs/topics/release-notes.md

Fix regression introduced by #4035

A view with no `authentication_classes` set and that fails a

permission check should raise a 403 with the message from the

failing permission.

Add Django Rest Messaging to Third Party Packages

type('') to str

updated minor django versions on tox

Reorder initializing the view

Add .partial_update to ModelViewSet documentation

The ModelViewSet inherits from the UpdateModelMixin, which provides the `.partial_update` method. This should be reflected in the documentation.

remove trailing slash from cramer cursor link

links to html-json-forms package

Do not ignore overridden View.get_view_name() in breadcrumbs

Fix None UUID ForeignKey serialization

Fix typo

Determining the version and performing content negotiation should be done before ensuring the permission of the request. The reason is that these information can be used in handling the exceptions. For example different versions may return different error scheme. Also, the rendering class can be used to determine how to exception handler response should be rendered.

Fixed use of deprecated Query.aggregates

In Django 1.8 [`Query.aggregates` is replaced by `annotations`](https://docs.djangoproject.com/es/1.9/releases/1.8/#aggregate-methods-and-modules).

Using aggregates currently raises a `RemovedInDjango20Warning`. [Django's source](https://github.com/django/django/blob/1.8/django/db/models/sql/query.py#L192)

Fix blank lines around docstrings