Fixes
- accept space runs in Bearer and DPoP credentials (3414db5)
- decode HTTP authentication quoted pairs correctly (bd7fcb0)
- forward arguments to AVA test runners (b898ba5)
- honor explicit auth-time skips in authorization responses (656d762)
- recognize DPoP nonce errors among multiple challenges (70bd8a1)
- release: separate changelog sections (a827c39)
- validate ID Token subjects and DPoP identifiers as strings (edbebeb)
Refactor
- consolidate ID Token validation policy (53900cc)