aaronpkthat seems like a good policy for indieauth.com though. If you've gone to the trouble of pointing to a specific authorization endpoint, it should only allow that option. also means it can redirect automatically and skip the prompt which is better UX
