The defaultPostLoginState option was not being used by the SDK, but now it is!

XHR requests now set the withCredentials option to true, allowing you to make cross-domain requests that will send the access_token and XSRF-TOKEN cookies. Your server must respond with the necessary Cross-Origin-Resource-Sharing (CORS) headers. If you are using our Express SDK this is done by specifying Allowed Origins on spConfig

The UI Router integration now accepts a forbiddenState option, this is the state we will send the user to if they are unauthorized for a given state. This is useful if you want to show a default "Forbidden" view in these situations.

Added documentation for the $stateChangeUnauthenticated and $stateChangeUnauthorized events!

The ifUserInGroup and ifUserNotInGroup directives now requires you to pass either a string expression or a reference to a scope variable. I.E. this will now throw a parse exception unless admin is a reference to a scope property:

<div if-user-in-group="admin">Hello, Administrator</div>

It should be re-written to be a string expression with quotes:

<div if-user-in-group="'admin'">Hello, Administrator</div>

The ifUserInGroup and ifUserNotInGroup directives now support regular expressions :)

See the documentation of ifUserInGroup for more information

• The logout directive is renamed to spLogout

• The registration form now uses property names of givenName and surname, instead of firstName and lastName

• Form submissions now use application/x-www-form-urlencoded as the Content Type. Your server needs to negotiate this type, if you are using our server SDKs this happens for you. If you wish to continue using application/json as the Content Type you can define STORMPATH_CONFIG.FORM_CONTENT_TYPE='application/json' in a config block

• whileResolvingUser is deprecatead. Use ifUserStateKnown instead.

• Custom Data on Registration. You can now pass custom data during registration, simply reference formModel.customData.myCustomProperty in your ng-model directive. This is only possible if you are supplying a custom template to the directive. See the spRegistrationForm directive for more detail.

• Group-Based Access Control. This can now control access to UI Routes, based on group membership. See SpStateConfig for examples. We've also introduced the ifUserInGroup and ifUserNotInGroup directives.

• whileResolvingUser would break after logout (user state was not properly reflected after logout)