Co-authored-by: Aminda Suomalainen <suomalainen+git@mikaela.info>

* version and changelog updates for 2.9.0-rc1

* review fixes to changelog and documentation

The landing page link doesn't seem to work right now.

Thanks @brettgilio!

1. Fix auth bypass in the default configuration with the addition of
   server.password (the REGISTER command was allowed before connection
   registration, allowing unauthenticated users to REGISTER and then
   take advantage of skip-server-password)
2. Caution operators against the use of require-sasl without disabling
   user-initiated account registration. (Such a configuration is still valid
   in the case of a public server that requires everyone to register.)

Issue #745 affected channels, not accounts. Since confusable protection
for channels was not implemented at all in 1.2.0, this bug was never present
in a release and shouldn't be in the changelog.