Aaron Parecki

This sounds great, and to be clear, none of this is new behavior defined by Micropub or IndieAuth, it's all part of the existing OAuth 2.0 spec that IndieAuth is based on. We can call this out explicitly but we should not be defining any new normative behavior and instead just reference OAuth 2.0.