mod_http_oauth2: Reflect ALL attributes of the client registration Per RFC 7591: " Additionally, the authorization server MUST return all registered metadata about this client, including any fields provisioned by the authorization server itself. " The idea is that the server may replace/drop fields in the registration, so what gets reflected back to the client is the source of truth about the registration.

<tr>
  <th>What is {x} {op} {y}?</th><td>
    <input name="captcha_challenge" type="hidden" value="{challenge}">
    <input name="captcha_reply" pattern="[0-9]+" required type="number">
  </td></tr>