2021-11-02 UTC
# 
aaronpk this may need more discussion. requiring that the issuer URL is a prefix of the two endpoints means indieauth.com and tokens.indieauth.com are not valid anymore. i don't mind too much, since i'm not planning on continuing those services, but it does mean you can't split the two endpoints into different domains