Import best practice log config from h
Use notes server as main entry
Replace session based oauth state with TOTP

Five minute timeout on signed timestamp for OAuth state validation.