Move OAuth2 endpoints extensions to the confirmance.security level