[dist] add dispatch constraints features to release notes
[api] save the attribute too in clean up job
[dist] fix OBS start page for appliance
[dist] use localhost as api for webui to avoid SSL verification in this situation
[api] fix typo and by it issue 567
[api] move do_branch function into it's own class

and split the big function into several smaller ones
[api] allow to accept reviews for delete requests

wrote a test case to highlight issue #550 and fix it with yet another
attack of the spaghetti code monster
[api] refactor the whole changestate permission check

This whole logic if a request can change state is worth an extra file, it's
almost 300 lines of code
[api] split the changestate check

the various action types require different checks so they can also have
different functions
[api] give delete requests for repositories different mails
[backend] kiwi requires SUMMARY for SLE 12 medias
[dist] require current build script
[dist] increase spec file version to be newer then 2.5 release
[backend] do not auto-wipe imported binaries when a package is excluded
[api] fix operation with osc again, send a 401 for modifying operations without given account, not 403
[api] fix test controller for webui testsuite
[webui] test and fix permission handling in patchinfo editor in anonymous mode
[webui] require login for editing patchinfo instead of error handling
[webui] apply require_login for most patchinfo editor routes
[backend] another fix for import handling of excluded packages