Release v8.3.5

• (@GermanBluefox) Fixed: after a single sign-on the access and refresh token were put into the address (?ssoLoginResponse=), so they ended up in the browser history and in the logs of a reverse proxy. Only a one-time code is there now, admin fetches the tokens with it. The ID token that came back after connecting an identity (?id_token=, with name and e-mail) is not kept any more, nothing used it
• (@GermanBluefox) Fixed: the session cookie of a single sign-on was readable by scripts and sent along cross-site requests, unlike the one of a password login
• (@GermanBluefox) Fixed: behind a reverse proxy with https the single sign-on sent http://.../sso-callback to the identity provider, which did not match the registered redirect URI. The protocol now comes from X-Forwarded-Proto, and the external address of admin can be set in the SSO settings
• (@GermanBluefox) Important for everybody who had the single sign-on switched on with an admin before 8.3.4: an identity that somebody else connected with a user stays connected after the update. Check on the "Users" page that every user with single sign-on is connected with the right account, and disconnect the others
• (@GermanBluefox) Fixed: the device manager crashed if a slider of a device got a value that is not a number (#3699)
• (@GermanBluefox) Added: the system settings have an "AI" tab to set up the AI provider, its API key and the model once for the whole system; only one provider can be active
• (@GermanBluefox) Changed: the tabs of the system settings stand on the left with icons, on a phone on top
• (@GermanBluefox) Changed: the AI assistant takes provider, key and model from the "AI" tab of the system settings