v3.2.0

The connection ceremony: a connection-only resource token (no scope, an interaction_code) no longer gets an auth token. The PS holds a pending record, sends the person to the resource's published interaction_endpoint with that code and a callback, and terminates on the resource's bounce — GET /aauth/bounce/:code — with { status: 'connection_established' } and no token.

mockin previously read a scope-less token as scope: '' and issued a token, so an agent driving a connect was told it had connected while no upstream OAuth had happened. See #13.

241 passing.