production.
=== Configuration changes in 1.28 ===
-
+* The load.php entry point now enforces the existing policy of not allowing
+ access to session data, which includes the session user and the session
+ user's language. If such access is attempted, an exception will be thrown.
=== New features in 1.28 ===