Update changelog
Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Conflicts:

	CHANGELOG
	program/lib/Roundcube/rcube_plugin_api.php
	program/steps/utils/save_pref.inc