authorization_urlreturns thestateit puts in the URL, andget_api_tokenonly accepts a redirect that carries it, through the newlisten_for_redirect_with_state.- Stop logging the access token and API token.
- Correct the docs: the API token is what expires after 24 hours.
AuthorizationInfo gains a field, which breaks code that constructs it.
Split from #6.