- Turned on CSRF validation by default.
- Added access control for login, signup and logout for frontend application.
- Added access control for login, logout and index for backend application.
- YII_ENV is now defined for all applications.
- No trace is writted to logs if debug is turned off.
- Added default error view for frontend and backend.
- In frontend application captcha will always ask for "testme" if YII_ENV is defined as "test".

Added console command support to the bootstrap app.

app is resposible for setting time zone, so it should also do the
fixing.
+ documentation about the behavior.
issue #210 and #209

See https://github.com/yiisoft/yii2/issues/123#issuecomment-17657374
Issue #123

Refactoring AssetConverter.

added more exception classes.
working on request and response classes.