#dev 2017-10-28

2017-10-28 UTC

aaronpk also says client authentication should be included but since we only use public clients we wouldn't need that. We could say that the client should include its client id tho