#dev 2016-12-12

2016-12-12 UTC

aaronpk i think the conclusion we came to before is you should use whatever comes back from the auth endpoint as long as it's on the same domain as what was entered