Concerns about access token in URL and browser history

Any updates to this?