Thanks to Miroslav36.

Our tokens are not revocable, they should not be generated with
a large lifetime.  Don't encourage users to do that.

We had two functions with the same name.

This avoids the need to pass the username in the URL without
requiring the client to parse tokens.

Now that we support external auth, the permissions list is
open-ended.  Make it a list for simplicity.

It is now possible to autojoin by going to a URL such as

  https://galene.example.org/group/test?username=jch&token=...

This makes it possible to use token authentication without
an authentication server.

https://github.com/LucasReade/Contextual.js

Nice DTLS fixes in pion/dtls v2.1.2.

This was broken when we renamed status to data.  Thanks to
Sylvie Tissot.

This fixes an issue with non-simulcast tracks being discarded
when bundled with simulcast tracks.

More explicit data structures, better error handling.