• Reject Bungie OAuth callbacks whose state parameter is missing when no state was stored, closing a login CSRF where an attacker-supplied code could be exchanged.
• The Loadout Optimizer is up to 2x faster when activity mods are locked.
• Loadout Optimizer no longer waits for vendors to load.
• Link to the user guide for why Loadout Optimizer / Loadout Analyzer can be slow from the Loadouts and LO pages.
• Added missing is:inloadout filter suggestion.