Tomoauth

addresses activity URIs, state/profile agent validation, token scope