2021-06-09 UTC
# 
Saphire ...and a separate flow of
{code, redirect_url, client_id} to same endpoint where it checks the token (in opaque way) and just goes nah, or ok and gives user info?