v0.3.1

Fixed

• Encode the path of the redirect that removes the access token from the URL only once.

Security

• Refuse a path starting with /\ as the target of the access token redirect.
• Mark the session cookie Secure when KEYMAKER_PUBLIC_URL is an https address.