Fix for session getting.
Query string handling in multilingual setup redirect.
Fix for `api/System/profile` returned 404.
Breaking changes: `/OAuth2/token` and `/OAuth2/invalidate_token` are used only with `POST` method instead of `GET`.
API requests using `access_token` in any form doesn't need `client_id` and `client_secret` anymore.
Support for `Authentication: Bearer {access_token}` from RFC 6750.
Fixed clients removal.
Added documentation about `refresh_token` usage.
Various fixes and simplifications.