maybe note that this will show up in the oauth permission page presented to the user.
I think the permission page should also show the domain associated with the 3rd party application (maybe from these callbacks?) just in case they started on one page that looked like company A but actually get redirected back to Company B after they've granted permissions.