Merge "API: Remove deprecated response values from action=login"

diff --combined RELEASE-NOTES-1.28
index 5b77ac2,53fdc83..cff734b
--- 1/RELEASE-NOTES-1.28
--- 2/RELEASE-NOTES-1.28
+++ b/RELEASE-NOTES-1.28
@@@ -53,6 -53,9 +53,9 @@@ production
    the value of $wgMaxArticleSize.
  * Property 'modulemessages' from action=parse&prop=modules was removed
    (deprecated since 1.26).
+ * The following response properties from action=login, deprecated in 1.27, are
+   now removed: lgtoken, cookieprefix, sessionid. Clients should handle cookies
+   to properly manage session state.
  
  === Action API internal changes in 1.28 ===
  * Added a new hook, 'ApiMakeParserOptions', to allow extensions to better
@@@ -85,8 -88,6 +88,8 @@@ changes to languages because of Phabric
    were replaced by HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd
    respectively. See docs/hooks.txt for the specific changes needed for those hooks.
  * The 'ParserLimitReportFormat' hook was removed.
 +* Disabled "bug 2702" HTML tidying of parsed UI messages on wikis where Tidy is
 +  disabled.
  
  == Compatibility ==