Revisit OAuth client validation

[wmurphyrd]

The current logic looks for a client with a registered redirectUri that matches exactly the protocol & host portion of the requested redirectUri. It was setup this way so that having a room id in the path wouldn't prevent validation (e.g. Hubs rooms), but I have two concerns:

1. If the hub value from the config contain any path, then it can never be matched. While this isn't a documented way of specifying the hub domain, setting hub to e.g. immerdomain.com/index.html works in all other respects for using a static site served by the immer as the hub (https://github.com/immers-space/nice-free-treasures)
2. There may be potential for abuse if another app could get deployed on the same host (maybe some shared hosting service situation) and could then impersonate other clients on the host

      const url = new URL(redirectUriFull)
      const redirectUri = `${url.protocol}//${url.host}`
      const client = await db.collection('clients').findOne({ clientId, redirectUri })

immers/src/authdb.js

Lines 89 to 91 in 015814e

	const url = new URL(redirectUriFull)
	const redirectUri = `${url.protocol}//${url.host}`
	const client = await db.collection('clients').findOne({ clientId, redirectUri })