Fixed token refresh for clientless access tokens
Added scope reduction to refresh token grant

It is now possible for clients to reduce the scopes for an access token
when refreshing it
Support for multiple redirect_uris added.
Renamed Application#redirect_uri in redirect_uris
Merge pull request #326 from ianunruh/master

Fixed token refresh for clientless access tokens
Changelog update
Bugfix: access token scopes are strings

[fixes #329]
Releasing 1.0.0.rc1
mongoid3 test fix
Update code to specs to run under Rails 4.1.0.beta1, add to .travis.yml
Add Ruby 2.1.0 support, which also should re-run specs
Tidy up the Rails versions - see if this kills the transient Travis CI failure.
Merge pull request #333 from petergoldstein/feature/rails_4_1

Initial Rails 4.1.0 support
Update README: Ruby >1.9.3 and Rails >3.1
CHANGELOG update
require in favor of autoload

See
http://tenderlovemaking.com/2012/06/18/removing-config-threadsafe.html
support the spec of 'invalid_token' response

WWW-Authenticate header is required when authenticate error.
see it: http://tools.ietf.org/html/rfc6750\#section-3
Better error responses, including more use of WWW-Authenticate
Do not force a Content-Type when handling unauthorized errors
Make the InvalidTokenResponse object available to views