0.5.1

Summary

• Added WWW‑Authenticate header for 401 responses and X‑Credential‑Username to Basic and HMAC auth plugins.
• Disabled SSLv3 to mitigate POODLE (CVE‑2014‑3566) and removed key‑auth key‑in‑body support.
• Fixed error handling: Admin API accepts JSON on CORS, HMAC plugin migration runs, wrong credentials and missing JWT iss now return 403, OAuth2 client‑credentials flow no longer includes a refresh token, and plugin updates without config ...