Release v2.56.0

Summary

Request authentication is now selected once and consistently, and refuses ambiguous credentials instead of guessing.

Changed

• A request that presents a bearer token together with a browser session cookie on a non-bearer route is refused as ambiguous. Bearer routes consult the bearer credential alone: a session cookie beside it is ignored, never validated and never forwarded, and a rejected bearer is never rescued by the cookie. If a client sends both on a non-bearer route, send only one credential.
• Browser session recovery and sign-in access are limited to the matched local authentication endpoints.
• Client-credentials access tokens are refused at or after their protected expiry.