Merge branch '2.7' into 2.8

* 2.7:
  [php7] Fix for substr() always returning a string
  [Security] Do not save the target path in the session for a stateless firewall
  Fix calls to HttpCache#getSurrogate triggering E_USER_DEPRECATED errors.
  [DependencyInjection] fixed FrozenParameterBag and improved Parameter…

Author: nicolas-grekas

Http/Firewall/ExceptionListener.php

@@ -47,8 +47,9 @@ class ExceptionListener
     private $errorPage;
     private $logger;
     private $httpUtils;
+    private $stateless;
 
-    public function __construct(TokenStorageInterface $tokenStorage, AuthenticationTrustResolverInterface $trustResolver, HttpUtils $httpUtils, $providerKey, AuthenticationEntryPointInterface $authenticationEntryPoint = null, $errorPage = null, AccessDeniedHandlerInterface $accessDeniedHandler = null, LoggerInterface $logger = null)
+    public function __construct(TokenStorageInterface $tokenStorage, AuthenticationTrustResolverInterface $trustResolver, HttpUtils $httpUtils, $providerKey, AuthenticationEntryPointInterface $authenticationEntryPoint = null, $errorPage = null, AccessDeniedHandlerInterface $accessDeniedHandler = null, LoggerInterface $logger = null, $stateless = false)
     {
         $this->tokenStorage = $tokenStorage;
         $this->accessDeniedHandler = $accessDeniedHandler;
@@ -58,6 +59,7 @@ public function __construct(TokenStorageInterface $tokenStorage, AuthenticationT
         $this->authenticationTrustResolver = $trustResolver;
         $this->errorPage = $errorPage;
         $this->logger = $logger;
+        $this->stateless = $stateless;
     }
 
     /**
@@ -185,7 +187,9 @@ private function startAuthentication(Request $request, AuthenticationException $
             $this->logger->debug('Calling Authentication entry point.');
         }
 
-        $this->setTargetPath($request);
+        if (!$this->stateless) {
+            $this->setTargetPath($request);
+        }
 
         if ($authException instanceof AccountStatusException) {
             // remove the security token to prevent infinite redirect loops