> it's a bit weird, but JWTs always arrive as GET parameters. I don't know why we did that, heh. It's frozen on the platform forever now.

That said we could potentially change the url e.g. if we wanted to optimise it as a fragment id later on rather than sending the data.