Stormpath.Owin v4.0.0-rc5

• The /oauth/token route will now return 400 Bad Request if the username or password fields are missing. This shouldn't be a breaking change compared to the previous Stormpath functionality, but earlier versions of the migration code failed with a less-helpful error message here.

• The /me endpoint will now return the user's groups if expand: groups is set in the configuration (this unbreaks a previously-breaking change). Compared to previous Stormpath functionality, the embedded group object does not have an href (it has an id instead), and the Status property is always enabled (because groups in Okta cannot be disabled).

The full list of changes for version 4.0 is in the changelog. As always, you can reach out to support@stormpath.com or post an issue here if you run into problems.