Breaking changes:
* various public members of classes are now protected and can only be configured on instantiation
* `issuer` key is now semi-required in the Server config array (omitting it will result in a warning)

Other changes:
* Everywhere which previously accepted a custom template path now additionaly support callables with the following signature (#18)
  ```php
	function (array $context): string
	```
* Client ID web pages are now searched for matching h-x-app microformats in addition to h-app (#17)
* If a valid author property is present on the client ID h-(x-)app, DefaultAuthorizationForm and its corresponding template make it available and present it (#16)
* Improved documentation with internal links, better formatting
* Allowed DoubleSubmitCookieCsrfMiddleware’s cookie path to be set to arbitrary values (not useful for internal IndieAuth use, but handy for reusing that code elsewhere)
* DoubleSubmitCookieCsrfMiddleware adds a pre-rendered CSRF form element attribute to $request for convenience