Don't expose your tokens on the web
Add diagnostics for java oauth handling
Show both client token and session tokens - format in HTML
Set Expires_in override for consent flow tokens
Consent scopes diagnostics
Put a session wait around token refresh
Synchonized the wait
Update README with release notes
Update api doc comments with correct default values for new oauth fields