explicitly mentioned; a version number like 1.1 implicitly includes
all 1.1.x versions.
+* 2.0 -> 2.1
+
+** Authentication
+
+Users are now stored in the database rather than in 'allow' directives in a
+private configuration file. 'allow' is still understood in this version, but
+is only used to populate the database on startup. After the first (successful)
+run of the server the remaining 'allow' directives can be deleted.
+
+'allow' will stop working entirely in a future version.
+
* 1.4/1.5 -> 2.0
** 'transform' and 'namepart' directives