Robert
Add sort=username,ASC query option to /api/v1/users/connections. and probably other requests.
There should be some rate limiting of incoming requests. Current implementation creates/expires Sessions for IP:port. Could be basis for own implementation. If not doing own leaky-bucket implementation, consider removing Sessions...
Currently, domain tokens have a long life (one year). Domains can come and go and this can cause tokens to pile up. Create an API operation or add a token...