Release v2.57.0

Changed

• A bearer request that also carries a browser session is now refused as ambiguous with a 400 JSON error, and no verifier runs. Send either the bearer token or the browser session on a request, not both. (part of #256)
• A bearer token supplied only as an access_token query parameter is now refused with 400 whether or not an Authorization header is present. (part of #256)

Fixed

• An expired AuthProxy-issued client-credentials token is now refused with 401 invalid_token and is no longer retried through the external bearer validator. (part of #257)