Fixed bug causing CSRF token not to rotate on login.

Thanks Gavin McQuillan for the report.
Fixed ReST error in 1.6. release notes.
Added a warning regarding session security and subdomains.