We just upgraded to 5.x so too late. We are still testing though the changes from 3.9 to 5.0.
One thing we have seen and we can't explain is that we have some blogs that can be read only when you are logged in so not public. We have a link on our homepage to go to several of these blogs. Before the upgrade, the user had a page saying he/she needed to be logged in to see the blog but now after the upgrade, the page displayed is the 400 message ( You are not authorized to view this blog entry.)
We must be missing something in the settings somewhere but we didn't see anything related to this.
Do you know where it can come from and how to resolve this?
We had to put the blogs public to avoid the problem so it is not ideal but better than a dead end like the 400 message.
As an example, we created this blog
https://www.baypayforum.com/opinions/blogs/entry/test-of-access that can be only accessible when you are logged in. This works well. When not logged in, we get the 400 message.