It looks nice. Are there plans to (try to) remove all the GET request parameters from the authentication flow? The Authorization request maybe seems one (the browser would need to support that, or use Javascript, or maybe a shortlived cookie) And also "8" GET tokens using the code, is potentially one?

I think you didn’t reply to what you intended.