Merge pull request #572 from Cheddam/pulls/6/alc-changes

DOC Add notice regarding session renewal API changes

en/08_Changelogs/6.0.0.md

@@ -48,6 +48,7 @@ title: 6.0.0 (unreleased)
   - [`RedirectorPage` validation](#redirectorpage-validation)
   - [Update JS MIME type, remove `type` in `<script>` tags](#js-mime-type-update)
   - [`getSchemaDataDefaults()` now includes attributes](#formfield-schema-data)
+  - [Remember me token rotation](#remember-me-token-rotation)
 - [Full list of removed and changed API (by module, alphabetically)](#api-removed-and-changed)
 
 ## Change to commercially supported modules {#changes-to-support}
@@ -1127,6 +1128,12 @@ If you were calling `getSchemaData()` in your `getAttributes()` method in a `For
 +<div $AttributesHTML $SchemaAttributesHtml></div>
 ```
 
+### Remember me token rotation
+
+[`RememberLoginHash`](api:SilverStripe\Security\RememberLoginHash) no longer rotates its token during session renewal, and related config to control this has been removed. This has no functional impact on the Remember Me feature, and resolves some edgecases that could trigger an unexpected logout.
+
+The related `onAfterRenewToken` extension hook has been renamed to `onAfterRenewSession`, and is triggered at the same logical step in the session renewal process.
+
 ### Full list of removed and changed API (by module, alphabetically) {#api-removed-and-changed}
 
 <!--- Changes below this line will be automatically regenerated -->