Comment by GloriousMEEPT

You're right, we're not strictly implementing things according to the spec/oauth 2.1