Token theft

A leftover localhost callback lets Cognito hand OAuth tokens to whatever binds port 3000

Cognito validates the redirect target by matching it against the app client's allowed callback list, so a development entry nobody removed is a valid destination for an authorization code, or for the tokens themselves where implicit grant is still on.