v4.0.0

Changed

• Make every public parameter either keyword-only or positional-only. The requestor,
  authenticator, and authorizer subjects of the authenticator and authorizer
  classes, the parameters of :class:.Requestor, :meth:.Session.request, and
  :meth:.BaseAuthenticator.authorize_url, the only_access argument of
  :meth:.Authorizer.revoke, and the session factory are now keyword-only, while
  the single obvious operand of a method (such as the token argument of
  :meth:.BaseAuthenticator.revoke_token, the code argument of
  :meth:.Authorizer.authorize, and the response argument of the exception classes)
  is positional-only.