John Cardinal
80f81aea0f
A password set by someone else (reset code, administrator) or a disabled login replaces the user's session token and download key; changing one's own password keeps the session. PasswordResetCodeExpire is cleared (was DlKeyExpire). The token middleware exempts only the exact login and notify/hello routes and refuses inactive users and users who may not log in. With a purchased licence, notify/hello no longer offers the default SuperUser login and a SuperUser with the default password may only change it (SuperUserDefaultPasswordRoutes). F7, F8 and F9 fixed. Manual and changelog updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>