I also like the idea. we should just take a cautious look at possible security implications of allowing to pass arbitrary callback URLs. My gut tells me that this could somehow be misused in order to mislead users and/or trick them into performing something they didn’t intend to. Any thoughts?