Merge remote-tracking branch 'origin/branch-5.0'

Conflicts:
	CHANGES.html

diff --cc CHANGES.html
index 65f10ae9576bcc877088f4d340d9f9a5116c9136,008cc8757806d62a9d756d37ce2be0aa6ee5eb19..75a9ef48d3d2dd6f0beac5ea0269820ddf0dfc47
--- 1/CHANGES.html
--- 2/CHANGES.html
+++ b/CHANGES.html
@@@ -11,69 -68,15 +11,78 @@@
  <p>This file documents recent user-visible changes to <a
   href="http://www.greenend.org.uk/rjk/disorder/">DisOrder</a>.</p>
  
 +<p><b>IMPORTANT</b>: you should read <a
 +href="README.upgrades.html">README.upgrades</a> before upgrading.</p>
 +
 +<h2>Changes up to version 5.1</h2>
 +
 +<div class=section>
 +
 +  <h3>Removable Device Support</h3>
 +
 +  <div class=section>
 +
 +    <p>The server will now automatically initiate a rescan when a filesystem is
 +    mounted or unmounted.  (Use the <tt>mount_rescan</tt> option if you want to
 +    suppress this behavior.)</p>
 +
 +    <p>The server takes care not to hold audio files open unnecessarily, so
 +    that devices can be unmounted even if tracks from them are currently being
 +    buffered.</p>
 +
 +  </div>
 +
 +  <h3>Disobedience</h3>
 +
 +  <div class=section>
 +
 +    <p>You can now edit the <tt>required-tags</tt> and <tt>prohibited-tags</tt>
 +    global preferences in Disobedience
 +    (<a href="http://code.google.com/p/disorder/issues/detail?id=29">issue
 +    #29</a>).</p>
 +
 +  </div>
 +
 +  <h3>Backups</h3>
 +
 +  <div class=section>
 +
 +    <p>The Debian package now includes a cronjob that backs up the database
 +    daily.  See <tt>/etc/cron.d/disorder</tt>.  You can put settings
 +    in <tt>/etc/default/disorder</tt> to turn this off or to control how long
 +    the backups are kept for.</p>
 +
 +    <p>The <tt>disorder-dump -r</tt> option was broken.</p>
 +
 +    <p><tt>disorder-dump</tt> now gets permissions right automatically (<a
 +    href="http://code.google.com/p/disorder/issues/detail?id=56">issue
 +    #56</a>).</p>
 +
 +  </div>
 +
 +  <h3>General</h3>
 +
 +  <div class=section>
 +
 +    <p>Unicode support has been upgraded to <a
 +    href="http://www.unicode.org/versions/Unicode6.0.0/">Unicode
 +    6.0.0</a>.</p>
 +    
 +    <p>Various minor bug fixes.</p>
 +
 +  </div>
 +
 +</div>
 +
+ <h2>Changes up to version 5.0.3</h2>
+ 
+ <div class=section>
+ 
+ <p><b>Security</b>: Local connections can no longer create and delete users
+ unless they are properly authorized.</p>
+ 
+ </div>
+ 
  <h2>Changes up to version 5.0.2</h2>
  
  <div class=section>

diff --cc server/server.c
Simple merge