What's new in 2.10.11

global.js began adding the CSRF header to same-origin XMLHttpRequest calls. The restricted-site gate can send visitors without a session to authentication while preserving recovery routes. The release also addressed MSYS path conversion and SSH execution as the project user, and separated validation-failure limits from authentication-attempt limits.