indieweb/indieauth

closes #14

for #8

since the redirect rules may cause this URL to be different from what the user entered

> If an HTTP permament redirect (HTTP 301 or 308) is encountered, the client MUST use the resulting URL as the canonical profile URL.

closes #11

Renames the section headers for the authentication section to say "authentication", as well as in a few places in the diagrams and text. Note that the "authorization code" is still always called authorization code even for the authentication flow.

closes #13

…ding the Link header


closes #9

to indieauth.spec.indieweb.org

closes #10

for #2

require that the auth server sets a default scope

closes #6

… examples

for #2

these examples are based on various combinations of profile URLs  seen in the wild

closes #7

closes #5

closes #4

…verification

closes #1