Updated disclaimer.
Moved redirect uri from client-secret to header.