#dev 2016-07-29

2016-07-29 UTC

aaronpk in that case, the client still has to verify the auth code (at the auth server) so it wouldn't be needed there either as long as the client is using "state"