v0.3.5

This is the version stable 0.3 release, and is backwards compatibility breaking.

Both this package and the @curveball/oauth2 now use the @badgateway/oauth2-client library for OAuth2 plumbing.
Setting up this middleware now requires an instance of the OAuth2Client class to be provided, instead of providing all the individual settings.

One advantage is that it can piggyback on all of oauth2-client features, in particular this adds support for:

1. PKCE
2. Endpoint discovery

The publicUri setting is also gone. Instead you should set the CURVEBALL_ORIGIN environment variable.