Do not fail login if token auth secret is unavailable in SessionInitializer.
Documentation tweak.
Add _isPasswordHashed parameter to UsersManager.addUser (mirrors parameter in UsersManager.updateUser).
Fix #6344, add missing return statement removed from recent refactor to Cookie::get().