Zegnat!tell aaronpk is it worth reiterating somewhere in the IndieAuth spec that scope and state are parameters borrowed straight from OAuth and should not contain codepoints not allowed by OAuth? That's how selfauth works, but I am not sure the spec .ales it clear.
