v4.0.0

What's Changed

• fix!: deleteUser takes id, not email by @lakhansamani in #53
• feat: support the RFC 8707 resource indicator in authorize() by @lakhansamani in #54
• test: pass --url, required by server 2.4.0 by @lakhansamani in #55
• fix: persist the mfa session cookie outside the browser by @lakhansamani in #52
• fix(test): bind the port advertised as --url by @lakhansamani in #56

Full Changelog: v3.3.0...v4.0.0