v4.9.0

• feat: Rewrite sessions as a lazy, store-based layer by @techmahedy in #398
• fix(http): make request/response handling consistent end to end by @techmahedy in #399
• fix(security): harden redirects, error views and debug output by @abdulmajidcse in #401
• fix: correct old input, validation rules, route lookups and error responses by @abdulmajidcse in #402
• feat(session): add a database session driver and logout from other devices by @techmahedy in #400