v0.12.7

• Update all dependencies

v0.12.6

• PUBLIC_URI is now correctly being auto-detected if it was not set in the
  environment in standalone mode.
• Improved error messaging when the server fails to start.

v0.12.5

• Now using @curveball/accesslog, which also colorizes CLI output when
  viewed on a terminal.
• A list of privileges are now returned from the 'introspect' endpoint.
• An error will be thrown when the server is used as a middleware (instead
  of standalone) and no PUBLIC_URI environment variable is set.

v0.12.4

• Added user links to accessToken

v0.12.3

• Added user links URL to introspect for 'authenticated-as' link

v0.12.1

• Bug fix. Curveball-session shouldn't have been dev dependency.

v0.12.0

• Added a /privileges endpoint to easily find out what kind of privileges
  are used in the system.
• The server now has an admin privilege, which is required to create new
  users or find information about other users.
• Users that are not yet marked active now show up in the /users
  collection, but still can't log in.
• The session cookie now uses SameSite: Lax, which means that users will see
  login screens less often.

v0.11.2

• Support for the /.well-known/change-password endpoint, as defined in
  RFC8615.
• Fixed a bug that could cause the TOTP field to not be rendered, even if it's
  required.
• Fixed a bug where users weren't getting activated using the "Create user"
  form.

v0.11.1

• Last release broke the OAuth2 authorization endpoint.

v0.11.0

• Support for a new user type: 'group'. Groups can contain users and will in a
  future release allow roles to be created with privileges that can be applied
  to entire groups.
• TOTP can now be set to 'required', 'optional' and 'disabled' via a server-
  wide flag.
• OAuth2 access, refresh and authorization code expiry times are now
  configurable.
• Better design for notifications vs. error messages.
• It's now possible for an admin to create new users via an API or form.
• It's now possible to authenticate with the a12nserver via a Bearer token,
  allowing clients to directly call a12nserver APIs.
• The OAuth2 login flow now also shows the lost password and registration
  links, if they were enabled.