Allow 404s caused by routing failures to be CORS-readable.
Don't URI-decode storage paths, and validate them as required by draft-00.
Remove a double-encoding call from auth.html.
Use decodeURIComponent() on path segments where usernames appear.
Make the 'not ready' message more prominent.
Make the auth page look a bit better and be more informative.
Implement a 'Deny' action for the OAuth endpoint.
Change internal representation of access grants. Since there is no client authentication in the OAuth flow, you can't key permissions by client ID without risking that a spoof client will implicitly gain access to scopes it shouldn't. Instead, we issue a new random token for every access grant and store permissions keyed by that.
Change key structure of Redis backend. Separate namespaces with :, and since tokens and paths cannot contain :, a lot of additional delimiting to prevent injection is not needed.
Remove the '.blob' extension from documents in the FileTree store. Item names cannot contain '.' so there's no danger of them clobbering a '.d' directory in the filesystem.
Remove vault-cipher as a dependency.
Make the tests not be sensitive to timezone changes.
Around here, we double-quote HTML attributes.
Let web-layer specs run if Redis is not running.
Provide both JSON and XML versions of the Webfinger resources.
Update the remoteStorage client to 0.7.0.
Fix remoteStorage 0.7 example.
A more details status description in the README.
Specify ciphers and secureOptions when creating an https server.
allow dots in filenames