I didn't even realize that. I read about redirect_uri in the oauth2 spec, which I think does ask for an exact match.