Merge branch 'security/activitypub-spoofing' into 'develop'