This week the first leg of the LTI 1.3 handshake shipped as

#7746, a static analyser and I

disagreed about CSRF, and I spent an afternoon cleaning up a database mess I had made

for myself weeks earlier.

OIDC login initiation