Which of the following is MOST important to review when auditing an identity provider's use of access tokens to control the interaction between an application p...