v0.23.0

The main reason this was released was due to a very scary Knex SQL injection bug that affects MySQL users.

• knex/knex#1227
• https://nvd.nist.gov/vuln/detail/CVE-2016-20018
• https://www.ghostccamm.com/blog/knex_sqli/

Other changes and new features:

• 'scope' wasn't supported yet correctly in the authorization_code and implicit flows.
• Fixed some bugs in the 'active sessions' report, and add columns for grant_type, and scope.
• Common types, such User, App, Group types have been moved to src/types.ts for easier access.
• We're now keeping track of which scopes were granted to which apps per user.
• Support for RFC 9068: A standard format for JWT OAuth2 Access Tokens.
• Centralize CSRF token handling (for old browsers).
• Added a new 'add privilege' action, which is helpful for API clients.
• Fix bug: Incorrect url in Location header when creating a new user.
• #448: Fix 'create group' form.