CURLOPT_SSL_VERIFYPEER.3. add a warning about disabling it
HTTP2: Support expect: 100-continue

"Expect: 100-continue", which was once deprecated in HTTP/2, is now
resurrected in HTTP/2 draft 14.  This change adds its support to
HTTP/2 code.  This change also includes stricter header field
checking.
ssl: provide Curl_ssl_backend even if no SSL library is available
gtls: only define Curl_gtls_seed if Nettle is not being used
HTTP/2: Fix infinite loop in readwrite_data()

To prevent infinite loop in readwrite_data() function when stream is
reset before any response body comes, reset closed flag to false once
it is evaluated to true.
Curl_ossl_version: detect and show libressl

LibreSSL is otherwise OpenSSL API compliant (so far)
Curl_ossl_version: adapted to detect BoringSSL

This seems to be the way it should work. Right now we can't build with
BoringSSL and try this out properly due to a minor API breakage.
darwinssl: don't use strtok()

The GetDarwinVersionNumber() function uses strtok, which is not
thread-safe.
parsedate.c: fix the return code for an overflow edge condition
RELEASE-NOTES: synced with 5b37db44a3eb
http_negotiate_sspi: Fixed endless unauthorized loop in commit 6bc76194e8

If the server rejects our authentication attempt and curl hasn't
called CompleteAuthToken() then the status variable will be
SEC_I_CONTINUE_NEEDED and not SEC_E_OK.

As such the existing detection mechanism for determining whether or not
the authentication process has finished is not sufficient.

However, the WWW-Authenticate: Negotiate header line will not contain
any data when the server has exhausted the negotiation, so we can use
that coupled with the already allocated context pointer.
http_negotiate_sspi: Fixed specific username and password not working

Bug: http://curl.haxx.se/mail/lib-2014-06/0224.html
Reported-by: Leonardo Rosati
TODO: FTP GSSAPI via Windows SSPI
TODO: HTTP Digest via Windows SSPI
docs: Added Negotiate to the SSPI current credentials usage description
runtests.pl: Pad test case numbers with up to three zeroes

Test case numbers with four digits have been available for a
while now.
openssl: replace call to OPENSSL_config

OPENSSL_config() is "strongly recommended" to use but unfortunately that
function makes an exit() call on wrongly formatted config files which
makes it hard to use in some situations. OPENSSL_config() itself calls
CONF_modules_load_file() and we use that instead and we ignore its
return code!

Reported-by: Jan Ehrhardt
Bug: http://curl.haxx.se/bug/view.cgi?id=1401
http2: show the received header for better debugging
HTTP/2: Move :authority before non-pseudo header fields
HTTP/2: Reset promised stream, not its associated stream.