#dev 2019-04-23

2019-04-23 UTC

sknebel GWG: I'd add it to the authorization request. at that point, you know a) what's requesting access b) that it wants authorization, not just authentication and c) have full control over the users browser