Accounts can add a second verification step at sign-in using an authenticator app or an email code. Users and administrators can manage their two-factor settings, and sign-in sessions remain limited until verification is complete.

Servlet request utilities can now delegate client IP detection to a configured resolver and use the direct connection address when the request bypasses a proxy.

Added URL-encoding helpers and made language lookup tolerate malformed request parameters.