backport stable

Fix name error introduced in c21d845836e4 c21d845836e4 use a ``vocab`` variable but doesn't define it. I assumed ``vocab`` is ``field.vocabulary(form)``.

Fix conditionnal logic broken in 195b24fe3a03 195b24fe3a03 replace: if not req.cnx: by if getattr(req, 'cnx', True): The "not" diseapeared in the process.

[session] provide a simple transaction context manager for session. Closes #1725640

[formwidgets] make the select size a class attribute (more easily tuned)

[bfss] Make ``current_fs_path`` return None when an attribute has no value current_fs_path was returning the future fspath when no value was defined. * This does not make any sense * This tricks the storage into believing that updating the attribute content is not necessary. The file was written but the attributes was not updated. as a result the assignement was not made. (close #1725446)

[selectors] take care, Session has no cnx

don't crash if we can't fetch data or if xml is malformed

[datafeed] extract some methods from pull_data to ease writing custom datafeed sources

drop useless code

backport stable

[datafeed] we should use utc timestamp to avoid pb with local times

[test] fix failure introduced by yams'changeset 644:f9c79356b758

[testlib] add convenience assertion method to check __message

[test] fix failure introduced by 1719eab69551: the regexp should be fixed, not the error message

[web test] fix test failures introduced by 7431:cab99ccdb774

backport stable changes

[ui message] fix regression introduced by 7429:ef5165fa99e0, leading to 'None' message displayed in the ui

backport stable changes

[json controller] fix .exception call msg format string (missing one slot)

[test] fix tests broken by 7427:5338d895b891

merge default heads

[ui messages, xss] Start migration towards use of _msgid instead of __message (prone to XSS injection) closes #1698245

backport stable