#dev 2019-10-30

2019-10-30 UTC

[fluffy] so the choices are either: specify that the token endpoint must pass through all the request args back to the authentication endpoint, or give a master list of whitelisted request args and only have a really good reason for ever adding more