v0.10.0

• Added a 'lost password' feature that uses email for validating using
  accounts.
• The audit log now tracks the 'User agent'.
• Better autocomplete hints on the login and registration form for password
  managers.

0.4.1

• refresh_token can now be used without a client secret.
• authorization_code no longer requires a client secret.
• authorization_code grant now returns a refresh token.
• The token endpoint now returns cors headers.

0.4.0

• Default port is 8531.
• Added a 'Getting started' guide.
• Added all database schemas to set up a new server.
• The password grant type is now supported.
• Refreshing tokens now works.
• The allowed_grant_types is now actively enforced for every client.
• Returning correct OAuth2 error responses for more internal errors.