April 2016 Web API Changes

[JeremiahFitbit]

• The Get Activity Logs List endpoint now returns device-created and automatically detected exercise logs. This was a backwards incompatible change to a beta endpoint. Announcement at https://community.fitbit.com/t5/Web-API/Breaking-change-to-Get-Activity-Logs-List/m-p/1277033#U12770...
• We implemented RFC 7009. Applications can now revoke the authorization they received from a user. Documentation at https://dev.fitbit.com/docs/oauth2/#revoking-access-tokens
• The Fitbit Web API will now append a hash fragment to redirect URIs when using the Authorization Code Grant Flow as a security measure related to how browsers preserve hash fragments through redirects.
• The behavior for forcing users to sign in before the OAuth 2.0 authorization page and/or re-authorize an app was clarified by the addition of `prompt=login consent`. Announcement at https://community.fitbit.com/t5/Web-API/Update-to-OAuth-2-0-authorization-page-prompt-parameter/m-p/...