https://www.pivotaltracker.com/story/show/66163326 - first, we tighten security on the /oauth/authorize URL by requiring scope=oauth.login so that we identify the login client. second we remove the login.addnew configuration flag. third, we read the addnew flag from a URL parameter called add_new
Relax security until we know what clients are using URLs they are not supposed to use. ie, what clients are passing in source=login to /oauth/authorize
since we have moved the flag, we have to take into account if we should set it or not. in the previous default environment, it would assume default=addnew[true]
We can now add a unit test for addnew: true that should succeed, and one that should fail.
remove references to addnew
Merge branch 'feature/add_new_parameter_from_login_server' into develop