2020-09-26 UTC
# 
Zegnat Will leave that to your disgression. I think https://tools.ietf.org/html/rfc7636#section-7.2 also makes the case very clear, but I know from experience that people will not read that far into the RFC because they will look for implementation details and not the security considerations...