v0.23.0
chore(dependencies): dependency upgrades
docs(authorization): Document email param in GET /authorization
feat(server): set HSTS header for 180 days

but do not set the other HAPI security headers (e.g., x-download-options)
chore(build): create changelogs each release

fixes #158
v0.24.0
feat(clients): client registration apis

This adds 4 new routes to manage clients, besides the existing
GET /v1/client/:id. The new routes are:

- GET /v1/clients
- POST /v1/client
- POST /v1/client/:id
- DELETE /v1/client/:id

These 4 routes are protected via the same Bearer token oauth scheme
that the profile server uses. Currently, it's scope is `oauth`.

Besides requiring a bearer token with the above scope, the email
associated with the token must match a whitelist. This whitelist is in
the config as `admin.whitelist`. The default is a regex matching
`@mozilla\.com$` email addresses.

An additional precaution is that these routes are currently disabled
when `config.env === 'prod'`.

fixes #60