- Force using the dedicated authentication site configured via auth-host - Stricter host validation - Using the restricted app consistently for all access control (instead of the old loginview).
Support user-navigable URLs at / as well as /auth/, allowing for a dedicated authentication site with pretty URLs.