lots of changes - main one is that users must confirm email address to show that they own it now