[schmarty]the tl;dr is that when i added support for using http://indielogin.com i completely goofed the logic so it would look up your metadata, set an expected issuer, then ignore your detected authorization endpoint and just use http://indielogin.com 🤦♂️