I introduced security context validation into controller.
I fixed a minor bug into @Controller security context validation. I fixed a bug into OAuth2UnauthorizedError constructor.
I improved tokens middleware so that it injects a security context even if token is not found in query parameters.
I added security context validation into roa_controller.
I introduced ROA resources dependent on user.
I added ROA user dependent into changelog.
I update ROA technical summary.
I updated the idp sql scripts to populate scopes accordingly to spec.