Hm, I need to reread that. I know that the query-args will vary (`code` is different each time), so it can't be a *complete* match. But it could require an exact match for the origin+path components. Github uses it as a prefix of the path (http://developer.github.com/v3/oauth/#redirect-urls), but I think it'd be ok if we required an exact path.

Adding a comment that said it must match the origin+path, but not the queryargs, would be fine.