= New Features

* An auto_remove_recovery_codes? configuration method has been added
  to the recovery_codes feature.  This will automatically remove
  recovery codes when the last multifactor authentication type other
  than the recovery codes has been removed.

* The jwt_access_expired_status and expired_jwt_access_token_message
  configuration methods have been added to the jwt_refresh feature,
  for supporting custom statuses and messages for expired tokens.

= Other Improvements

* Rodauth will no longer attempt to require a feature that has
  already been required.  Related to this is you can now use a
  a custom Rodauth feature without a rodauth/features/*.rb file
  in the Ruby library path, as long as you load the feature
  manually.

* Rodauth now avoids method redefinition warnings in verbose
  warning mode.  As Ruby 3 is dropping uninitialized instance
  variable warnings, Rodauth will be verbose warning free in
  Ruby 3.

= Backwards Compatibility

* The default remember cookie path is now set to '/'. This fixes
  usage in the case where rodauth is loaded under a subpath of the
  application (which is not the default behavior).  Unfortunately,
  this change can negatively affect cases where multiple rodauth
  configurations are used in separate paths on the same domain.
  In these cases, you should now use remember_cookie_options and
  include a :path option.
