tantek__I realize you're trying to lock down more things with IndieAuth (given the history of vagueness / lack of interop with OAuth), however, IndieAuth could likely benefit from another such "loose coupling" to WAM/h-app etc. to allow publishers / consuming code to work it out in the market
