Release v1.2.9

Security

• The default invitation token issuer and audience now percent-encode the EventStore and Namespace names, so deployments whose names contain : (for example Ante:Lobby/Prod and Ante/Lobby:Prod) can no longer derive the same issuer and accept each other's tokens. Names made only of letters, digits, -, ., _ and ~ keep their existing issuer. A deployment whose names contain any other character, including spaces and non-ASCII letters such as Ø, gets a new issuer: configure the new value in your proxy and expect invitation tokens issued earlier to be rejected, or set Issuer and Audience explicitly. (#155)