Let the authenticated dispatcher do the job to create new window or
handle request without window name. The REST ( /url/ ) must only
redirect the request to it if the user is already authenticated.

Implement a CSRF token to protect a little more against CSRF attack.
Enhance the UI framework to allow opening a link in a new browser
window.

OO-2575: better handle error during login with defective business path, fix NPE in artefact pool v1 if the portfolio v1 is disabled

OO-2402. don't try to launch a resource if there is nothing to launch, hardened the authentication dispatcher to accept manipulated urls and redirect them to the current page

OO-2248: implements a fully configurable Open ID Connect (Implicit flow) provider and make possible to collect several of them on the same OpenOLAT instance

OO-1949: remove entryUrl and replace it with businessPath, don't process business path in dispatcher if the login interceptors are visible...

OO-722,OO-1635: implements more business path in authoring environment and folder component, fix red screen

OO-1635,OO-722: refactor the ajax by iframe to use XHR, push the current business path to the browser via HTML5 push state, implements back button support via HTML5 History API...

OO-1561 replace lang parameter in pwd change and registration email with language parameter to not collide with html entity ⟨

OO-1362: make the guest login, links for guests and invitation login configurable in the administration GUI

OO-1251: return a copy of the list of enabled language to prevent concurrent modification red screens