Release 2.1.0: security hardening across authentication, OAuth and administration - #28

…tion links

…es the flow

…t admin role grants

…ced resets and audit atomically

…s and concurrent changes

…g bound values

…s and compare in constant time

…sswords on sign-in

…ts to per-client budgets

…th tokens atomically

… and quotas atomically

… and bind captcha tokens to the site

…ng unrecognized identifiers

…nd read secrets from files

…ration that sent the link

… reach of guessers

…n for every action that pushes out or reopens

…t of audit metadata and announce every deletion

…egistrations per address

…legation bound to the client as registered

…ow-bound secrets and require connection passwords

…ifetime or the trusted proxy boundary

…stener and mount secrets as files

…otes

…g accounts out from the administration

…ends from killing the live code

…ators clear a compromised account

…, not of administrators or endpoint secrets

…deletion and cap stored hash costs

…efuse every OpenID Connect parameter

…ask URL codes in logs

…pty or delete it

…cally and keep the primary client on the command line

…closed on token budgets

…ted sessions as sign-ins

…count states from harming users

…rop the recovery code burning route

… ids, and bound stored hash costs to twice the configuration

…ginx and rotate the access log in 14 days

…role changes to resets and the primary client

…egistrations from spending or squatting what others own

…igest and lock accounts once

…d keep outgoing events out of the runtime role's reach

…arrow client tokens to current scopes and trace device refusals

…ginx, read secrets from pass and grant owner functions by name