What's Changed
- shibboleth: Require spoofkey check for http; deprecate bypass by @jrchamp in #109
- shibboleth: Simplify role header, value checks by @jrchamp in #110
- Only allow redirects for approved hosts by @jrchamp in #112
Full Changelog: 2.5.2...2.5.3