> As a thumb rule never trust the client. The request headers and ability to interact with browsers are what provides you with relatively better state and session control. As an IDP provider I do not want to loose that and still be on the hook for security.

ok so why NOT allow extreme ui customization since client is untrusted anyway? i dont get it. theres no security concern (within this ui) bc the whole thing is untrusted.