* [Code Cleanup/Session] Fixed a bug where all sessions were prematurely logged out if a worker reset their credentials from Settings->Security.
* [CHD-3282] [Mail/Usability] When merging tickets from a worklist, the merge confirmation popup will now auto-focus the 'OK' button.  This doesn't interrupt keyboard shortcut workflows.
* [Virtual Attendants/Custom Fields/Code Cleanup] Fixed an issue where custom field changes weren't being cached properly in VA behaviors.  This didn't affect the actual records in the database, it just affected subsequent conditions and actions that used the newly set values.
* [CHD-3286] [Security/Login] The 'Remember me' cookie for the login process now uses the 'httponly' option. This prevents the cookie's contents (i.e. a valid worker email address) from being read in Javascript, which could potentially disclose some information to a malicious script in the browser.
* [CHD-3285] [Security/Attachments] Mail attachments with HTML content are now filtered through the HTMLPurifier library.  This strips Javascript code that would otherwise executed when the attachment is displayed in the browser.  Most email clients do not permit Javascript in HTML email, and Cerb shouldn't behave any differently.
* [CHD-3283] [Login/Google Auth/IE] When using Internet Explorer 8 and setting up two-factor Cerb logins using Google Authenticator, the QR code should now display properly.  If the <canvas> element isn't available, then the code will instruct the jQuery QR Code plugin to fall back to <table> rendering.
* [Security/Community Portals] The session cookie in Community Portals now uses the 'httponly' option to help protect against malicious browser scripts.
6.2.5 checkpoint