#5 changed access token from reference token (opaque string) to JWT; Added multiple audiences management (JWT claim generation based on scope list); increased security storing hashes instead of plain values for refresh_token and codes; General refactoring (TBC)