correct config doc on default session inactivity timeout: 300 secs
correct comment
fix using Bearer token Authorization header on JSON POST calls
support using a Bearer token on client registration calls
update ChangeLog for Bearer token authz on client registration
support hybrid flows
only validate the code against c_hash if the id_token is present...
fix debug printout