> The problem with not having the auth flow though is that Implicit is forbidden in the spec from sending down a refresh token. So it's usability vs testability?