@simon I think there's a new I-D for OAuth that does or can do something like this..