Hear. This one! So many of customers have been stabbed in the back with this one

What? That's token to self, you don't even really need an access token there. What's the actual use case for an access token where the client and the resource are the same app? (I'm aware of some, but we didn't expect most folks would follow that flow)