[portaouflop]

It’s hard / impossible to write a perfect spec maybe?

Or OAuth2 had a specific use case but has since been wrestled to do anything auth related