Define any missing attributes as NULL, to avoid notices of undefined index.
Explain in comments why (time() + 10), which seems a bit tricky.
Don't accept unknown authorization flows.
Trying to explain how the workflow of the server-side works.