Make the API not report collection data if user doesn't have access to the collection
Automatically handle untitled collections
Fix XSS on API key label entry.
Prevent CSRF on users add/edit/change-password.
Fix tests for new CSRF protections.
Bump version to 2.2.1.
Add CSRF tokens on appearance, settings, security
Expand disallowed PHP files in .htaccess
Add CSRF protection on themes actions.
Add CSRF protection for navigation.
Fix ThemesController test.
Don't save CSRF token as theme setting.
Added a call to parent search filters.