SECURITY: Only redirect to our host by path on the login action
SECURITY: User action route was returning too much data
SECURITY: GitHub authenticator returning unverified emails
Version bump to v1.0.1
SECURITY: Limit passwords to 200 characters

Prevents layer 8 attack.
SECURITY: Malformed URL could crash V8
SECURITY: Escape strings in logs
FIX: Resend activation email was busted
SECURITY: Stripping links could unescape html fragments
SECURITY: rate limit change email requests
Version bump to v1.0.2
SECURITY: rate limit user/password login
SECURITY: RegExp engine loopwith improperly formatted URLs.
Version bump to v1.0.3
Auto-anchor attribute regexes, document _validTags
FIX: Use lang- prefixes for HLJS; add nohighlight for ...

text; use a proper whiteListTag() call.

Old posts are not affected - no global rebake is necessary.
Clean up validateAttribute() function

Remove code duplication
FEATURE: Allow explicit rel="nofollow" on links
Fix JSHint
Fix data-* behavior (failure to understand own docs)