#dev 2017-12-18

2017-12-18 UTC

snarfed realized that i'm embedding my oauth state param in the redirect url, instead of passing it to the provider, which means my redirect urls are unique and never match the whitelist