mod_http_oauth2: Bind refresh tokens to client Prevent one OAuth client from using the refresh tokens issued to another client as required by RFC 6819 section 5.2.2.2 See also draft-ietf-oauth-security-topics-22 section 2.2.2 Thanks to OAuch for pointing out this issue

This module lets you block connections to any remote servers not on a
whitelist.

``` {.lua}
modules_enabled = {
    -- other modules --
    "s2s_whitelist",

}
s2s_whitelist = {
    "example.org",
}
```