https://www.cyberkendra.com/2014/05/security-flaw-found-in-oauth-and-openid.html