IndieAuth for WordPress 4.0 was released. It is a relatively minor update in the scheme of things. It enables expiring tokens by default…so clients you authorize will not have permission to post on your site forever, but for a time of your choosing. By default, 2 weeks. You can of course renew or disable expiry.