I admit I have no idea what the OAuth2 spec says about this, though.