Release 0.5.0

See changelog
Consider this case: A web server which is using 0.4.3 and has a route handler for their token endpoint, and that handler is accepting GET requests.  This handler is also calling `authenticateApiRequest` with a literal, not the `req` object provided by node, and this literal does not provide the `method` property.  Without the `method` property we cannot know that they are using GET and we cannot provide an error accordingly.  If we just “default” the missing `method` property to POST then we won't error and their application will be allowing the request as GET, without error - which is not correct, per RFC.