Browser-Based OAuth Client: The architecture you shouldn't be using