Comment by tybit

I’m embarrassed to admit but I’ve spent far too much time reading the minutiae of OAuth2 and OpenID and failing to grasp the big picture until now. This was really well done.