* The signed-value format used by `.RequestHandler.set_secure_cookie`
  and `.RequestHandler.get_secure_cookie` has changed to be more secure.
  **This is a disruptive change**.  The ``secure_cookie`` functions
  take new ``version`` parameters to support transitions between cookie
  formats.
* The new cookie format fixes a vulnerability that may be present in
  applications that use multiple cookies where the name of one cookie
  is a prefix of the name of another.
* To minimize disruption, cookies in the older format will be accepted
  by default until they expire.  Applications that may be vulnerable
  can reject all cookies in the older format by passing ``min_version=2``
  to `.RequestHandler.get_secure_cookie`.
* Thanks to Joost Pol of `Certified Secure <https://www.certifiedsecure.com>`_
  for reporting this issue.

Backwards-compatibility notes

* The C extension used to speed up the websocket module now compiles
  correctly on Windows with MSVC and 64-bit mode.  The fallback to
  the pure-Python alternative now works correctly on Mac OS X machines
  with no C compiler installed.