3.9.0

Changed

• Precompress CSS and JavaScript assets once at startup and serve them as br or
  gzip depending on the request's Accept-Encoding header, instead of
  compressing them again on every request.
• Serve the favicon under a content-hashed URL like the other assets so that it
  may be cached as immutable.
• Derive header, panel, gutter, accent, selection and Markdown admonition colors
  from the selected theme with WASTEBIN_THEME now recoloring the whole UI.
• Use a paste's title as the HTML page title on its own instead of prefixing
  the configured page title from WASTEBIN_TITLE. Pages without a title keep
  showing the configured title.
• Top-align the burn-after-reading and encrypt toggles with their labels.
• An empty password string in a JSON API payload now is interpreted as no
  password rather than an empty string.

Fixed

• With soft-wrap enabled, keep line numbers aligned with the lines.
• Copy a paste's content with LF line breaks intact.
• Send Cache-Control: no-store for password-protected pastes so that
  decrypted content and the password prompt are never cached.
• Localize expiration durations.
• Do not exit database handler and thus server on client timeout.
• Escape unhighlighted overly long lines.
• Deleting without a uid cookie now returns 403 instead of 200.
• Add security headers to service error responses.
• Show the burn-after-reading confirmation interstitial for the rendered Markdown
  view (/md/{id}) too, instead of revealing and burning the paste right away.
• Keep a paste's extension after submitting the password raw and download
  views.