minor point: this might want to be "redirectUriPrefix" to make it clear that we're not enforcing an exact match