-[**#2028**](https://github.com/hapijs/hapi/issues/2028) Improve error message when auth scope is insufficient
-[**#2029**](https://github.com/hapijs/hapi/issues/2029) Fixes #2028. Updated error message for invalid scope to explain that any of the specified are sufficient
-[**#2024**](https://github.com/hapijs/hapi/issues/2024) Resolve undefined environment variables to the empty string in the cli.
-[**#1103**](https://github.com/hapijs/hapi/issues/1103) allow arrays of scopes on routes
-[**#1116**](https://github.com/hapijs/hapi/issues/1116) CORS origin bug fixes and enhancements
-[**#1091**](https://github.com/hapijs/hapi/issues/1091) Only set access-control-allow-origin if the origin header value matches (or '*' is allowed)
-[**#1113**](https://github.com/hapijs/hapi/issues/1113) updates plugin.views Reference.md entry to a clear and working example
-[**#1094**](https://github.com/hapijs/hapi/issues/1094) 404 not being caught by onPreResponse function
-[**#1112**](https://github.com/hapijs/hapi/issues/1112) Too strict cookie parsing?
-[**#1114**](https://github.com/hapijs/hapi/issues/1114) What is the best way to access request headers?