Mark function "force_password" as deprecated
Use route name instead of path in controllers docs
Add "logged in" access check
Replace "/operator/updates.php" page with a controller
Create controller for awaiting-users actions
Add "history" controller