Stick with CC-BY-SA 2.0
Use https for various URLs
Changing the global socket timeout is evil
Add an OSM authentication provider
Remove some uses of user.message_set