Fixed constraints for 3.5” devices. Removed host verification from authorization callback. Production apps should probably check the redirect target URL before processing the request for security but it’s not required for this demo.