Fix typos in ReturnDict and ReturnList docstrings

ListSerializer fields or serializers that are passed many=True may also take an allow_empty=False argument to disallow empty lists as valid input.

Information about this was part of the 3.2 release announcement, but had not been part of the API docs until now.

Fix incorrectly named zh-hans and zh-hant locale path

Fixes a minor indentation typo.

This allows subclassing TokenAuthentication and setting custom keyword,
thus allowing the Authorization header to be for example:

    Bearer 956e252a-513c-48c5-92dd-bfddc364e812

It doesn't change the behavior of TokenAuthentication itself,
it simply allows to reuse the logic of TokenAuthentication without
the need of copy pasting the class and changing one hardcoded string.

Related: #4080

Fix typo in permissions docs

added python 3.5 checks for django 1.8

* Remove references to South as we don't need it any longer.
* Add a note about auth_token including Django migrations.

Added support for custom CSRF cookie names

Merge the changes in 3.3.x back to master.

Instead of hardcoding the CSRF cookie name, the value is passed to the template as a context variable, rendered as a JavaScript variable, and read by csrf.js.

Fixes #4048

* Made sure the OrderingFilter relies on Field.verbose_name.

* Marked OrderingFilter's order labels for translation.

# Conflicts:
#	docs/topics/release-notes.md

Fix regression introduced by #4035

A view with no `authentication_classes` set and that fails a

permission check should raise a 403 with the message from the

failing permission.

Add Django Rest Messaging to Third Party Packages