#dev 2018-07-01

2018-07-01 UTC

aaronpk it's so that your auth code verification bit doesn't get tricked into sending the auth code somewhere else, since you should first check that the state matches what you expect before verifying the auth code