add RC2 release notes and don't eagerly parse safe request bodies