Agreed, the authorisation bit is where I would spend my time. A server that authenticates fine on a laptop can still be the one handing a token to something that should never have held it, and no amount of clean protocol description catches that. The discovery half is genuinely tidy, the part after it is where the design work lives.