Amazon:

- mfa (sms + authenticator) supported

- explicit 4xx (invalid username/password/otp code) errors surfaced to the user

Sandbox:

- sandbox mode now supported.

- pass `?sandbox=true` as a Connect query param to go through the sandbox flow and generate a sandbox token

- sandbox uses fake/mocked data. 

Platform:

- `/disconnect` token now deletes data from the pay-api system. Previously it only marked the token as being invalid for use.

Website:

- security page created, explaining our security practices. visit it: https://pay-api.link/security