Update CHANGELOG.md for 8.13.9

[ci skip]

CHANGELOG.md

 Please view this file on the master branch, on stable branches it's out of date.
 
+## 8.13.9 (2016-12-08)
+
+- Reenables /user API request to return private-token if user is admin and request is made with sudo. !7615
+- Replace MR access checks with use of MergeRequestsFinder.
+
 ## 8.13.8 (2016-12-02)
 
 - Pass tag SHA to post-receive hook when tag is created via UI. !7700

changelogs/unreleased/24537-reenable-private-token-with-sudo.yml

----
-title: Reenables /user API request to return private-token if user is admin and request
-  is made with sudo
-merge_request: 7615
-author: 

changelogs/unreleased/jej-23867-use-mr-finder-instead-of-access-check.yml

----
-title: Replace MR access checks with use of MergeRequestsFinder
-merge_request: 
-author: