gRegoralso unsure if/how the introspection endpoint is supposed to work, since it requires authz. I implemented Client Authentication for it as a proof of concept, but there's no client secrets in the IndieAuth flow. Is that test just to ensure the 401 response?
