(Remember to include both the revision number _AND_ an abbreviated
description of the patch.)

Backport for 0.2.0:
  o r17135: ClientDNSRejectInternalAddresses not consistently obeyed.

Backport for 0.2.0 once better tested:
  o r16136: prevent circid collision.  [Also backport to 0.1.2.x??]

  - r16558: Avoid mis-routing CREATED cells.
  - r16621: Make some DNS code more robust (partial; see also libevent
            approach). (Also maybe r16674)
  - r17091: distinguish "no routers support pending circuits" from
            "no circuits are pending." See also r17181 and r17184.
  - r17137: send END cell in response to connect to nonexistent hidserv port.
  - r17138: reject *:* servers should never do DNS lookups.
  - r17139: Fix another case of overriding .exit choices.
  - r17162 and r17164: fix another case of not checking cpath_layer.
  - r17208,r17209,r7211,r17212,r17214: Avoid gotterdammerung when an
    authority has an expired certificate.