v2.6.1

This is a security release.

• Fix account enumeration through the password reset endpoints when Devise's
  paranoid mode is enabled. See
  GHSA-mc6q-7qq6-ghg8.

Stores using the Solidus storefront must also update the
UserPasswordsController in their own application; see
GHSA-mhwq-2v9w-r659.

What's Changed

• feat(User): Add timezone by @tvdeyen in #275
• Use bare config accessors by @jarednorman in #276
• Require Admin Credentials Outside Development/Test Environments by @jarednorman in #277

Full Changelog: v2.6.0...v2.6.1