Using HTTPS in the authorization flow