they both include changes that I haven't released in npm yet, pending merging in fxa-oauth-server.