let’s migrate one more of my tools to OAuth 2 tonight, I said. it should be straightforward, I said

then it turns out that tool had already struggled to fit its data into the session cookie in the past (I even wrote a test for it!), and OAuth 2 access tokens are substantially longer than OAuth 1.0a ones