COMMERROR is a cosmetic change (during auth we send error or greater to the client, not log), and the rest of the OAuth code uses ERROR, which then gets promoted to FATAL.
The main question is how much information we should include in the error message to the user, from that perspective Shihao's more generic message might be better. v3 is v1 + the COMMERROR and the error message change.
v3-0001-oauth-Recheck-oauth_validator_libraries-during-au.patch
Description: Binary data
