Apply this to fix the security issue reported at #11080. But apply it to a separate branch that starts from tag 0.9.0.
Maybe call the branch 0.9.x and create a new spkg based on it?
security fix: fix enable/disable of user registration
Ah.. Jason pointed out the commit which does this. Either merge this pull request or merge the commit 5723d40 in a separate branch.
Before merging look at #13270. If it is used "downstream" as 0.9.0.p0, then there is no need to merge it here.
For the record, this was closed by d8dfdb8, which is a backport of 5723d40 to 0.9.0.