2.2.6

• Escape user input in error messages to prevent potential server-side cross-site scripting
• status field in error objects is now a string, as required by JSON API standard
  https://jsonapi.org/format/#error-objects
• Returns '400' status if page number is provided but page size is 0
• Returns '400' status if unknown field was used for sorting
• Allow rolling back the current session in POST_RESOURCE post-processors (#28)