Update CHANGES

* Add check for regex denial of service (Ben Toews)
Handle more cases of non-literals in routes

Fixes #461
Merge pull request #462 from presidentbeef/fix_more_routes_without_literals

Handle more cases of non-literals in routes
Merge remote-tracking branch 'upstream/master' into gfm-output-upstream