= jwt Feature Additions/Improvements 

* JSON format responses now have the response content type set to
  application/json.

* The jwt feature now does not break if HTTP Basic or Digest
  authentication is used.

* If jwt_check_accept? is true, Rodauth will return a 406 error if
  a request Accept header is provided and it does not indicate that
  JSON is acceptable.

* Many new configuration methods have been added:

  * invalid_jwt_format_error_message: The error message to use when a
    JWT with an invalid format is submitted in the Authorization
    header.

  * json_accept_regexp: The regexp to use to check the Accept header
    for JSON if jwt_check_accept? is true.

  * json_not_accepted_error_message: The error message to display if
    jwt_check_accept? is true and the Accept header is present but
    does not match json_request_content_type_regexp.

  * json_request_content_type_regexp: The regexp to use to recognize
    a request as a json request.

  * json_response_content_type: The content type to set for json
    responses, application/json by default.

  * jwt_authorization_ignore: A regexp matched against the
    Authorization header, which skips JWT processing if it matches.
    By default, HTTP Basic and Digest authentication are ignored.

  * jwt_authorization_remove: A regexp to remove from the
    Authorization header before processing the JWT.  By default, a
    Bearer prefix is removed.

  * jwt_check_accept?: Whether to check the Accept header to see if
    the client supports JSON responses, false by default for backwards
    compatibility.

  * session_jwt: An encoded JWT for the current session.

  * use_jwt?: Whether to use the JWT in the Authorization header for
    authentication information.  If false, falls back to using the
    rack session. By default, the Authorization header is used if it
    is present, if only_json? is true, or if the request uses a json
    content type.

= jwt Feature Backwards Compatibility Issues

* The only_json? setting in the jwt feature is now only true by
  default if the :json=>:only option was used when loading the
  rodauth plugin into the roda app.  Previously, it was always true,
  but it only was considered in requests to Rodauth endpoints.  It
  now also is considered in most Rodauth calls, and if true will use
  an empty session instead of falling back to the rack session if an
  Authorization header is not present.

* Previously, the jwt feature only handled requests where the
  request content-type is JSON.  It now also handles non-JSON
  requests if the Authorization header is present or if only_json?
  is true.

* If an invalid JWT format is used in the Authorization header,
  Rodauth now returns a 400 error, instead of raising an exception.

= Other Improvements

* A template_opts configuration method has been added, for
  overriding the view/render options.  One possible use for this is
  to specify a non-default layout.