update package-lock
bump version
add url dep and bump
add version note and bump version
bump packages
handle async tokenGetter and custom factory function
make throwNoTokenError optional. Fix auth0#392.