Notes from the build.

Why I Don't Put JWTs in Redirect URLs

When OAuth login finishes, the easy move is to redirect back with the session token in the URL. It works on the first try — which is exactly why it's dangerous. Here's what I hand back in ArbFlow instead, and the reasoning behind it.