v1.6.4

Security

• Fix Pusher private channel authorization bypass: only sign the authenticated user's private-chatify.{id} inbox channel and the presence-activeStatus channel; reject all other channel names.