`auth_request_url` takes a scope parameter though, so it isn't necessary public/libertree.  Though, I guess if a wider scope is granted, then whoever is doing that is doing it at his/her own risk.  Our own code doesn't seem to make use of this parameter, either, so I guess we're okay.