= New Features

* create_account_set_password? and verify_account_set_password?
  configuration methods have been added to the create_account and
  verify_account features.  Setting:
  
    verify_account_set_password? true

  in your rodauth configuration will change Rodauth so that instead
  of asking for a password on the create account form, it will ask for
  a password on the verify account form.

  This can fix a possible issue where an attacker creates an account
  for a user with a password the attacker knows.  If the user clicks
  on the link in the verify account email and clicks on the button on
  the verify account page, the attacker would have have a verified
  account that they know the password to.

  By setting verify_account_set_password? to true, you can ensure that
  only the user who has access to the email can enter the password for
  the account.
