SECURITY: Only redirect to our host by path on the login action
SECURITY: User action route was returning too much data
SECURITY: GitHub authenticator returning unverified emails
Version bump to v1.0.1
SECURITY: Limit passwords to 200 characters

Prevents layer 8 attack.
SECURITY: Malformed URL could crash V8
SECURITY: Escape strings in logs
FIX: Resend activation email was busted
SECURITY: Stripping links could unescape html fragments
SECURITY: rate limit change email requests
Version bump to v1.0.2
SECURITY: rate limit user/password login
SECURITY: RegExp engine loopwith improperly formatted URLs.
Version bump to v1.0.3
FIX: prevent iframe in expended quote
SECURITY: Don't allow redirects with periods in case you don't control
other tlds on the same domain.
Version bump to v1.0.4
merge master
Version bump to v1.1.0
just say Delete