The JS function elgg.security.setToken is now formally marked private and its parameters are not backwards compatible. (9d8ddecb)

views: Sticky values now get passed into views extending register/extend (Fixes #8873)
memcache: don't store a copy of $CONFIG in file objects (Fixes #9081)

misc: Miscellaneous docs fixes (06e3557c)
permissions: Fix $params key name for permissions_check:annotate (1af6e3a2)
web_security: adds security warnings (d47fc5ed)
web_services: document the use of parameters in method declarations (750e31b9)

legacy_urls:
- adds missing forwarder for groups/forum/$guid (2b555f88, closes #8493)
- unset __elgg_uri to prevent infinite loops (0c7687ac, closes #8494)
profile: Avatar cropper again can be moved immediately after uploading image (d8cf51b7, closes #8449)
relationships: Invalid relationship names throw properly (ac976e23)
ui: prevent button jumping on widget add panel toggle (088de48d)
web_services: no longer uses deprecated export global (3a818d2b)