Documentation note a workaround for redirect_uri with query string or bare origin (e9689de), closes #868 Fixes passport: delete one-time state on callback (1e7dd2e)