diff --git a/oauth3.browser.js b/oauth3.browser.js
index 0c4e6b3..8ba8f02 100644
--- a/oauth3.browser.js
+++ b/oauth3.browser.js
@@ -19,7 +19,6 @@
       }
       opts = opts || {};
       opts.debug = true;
-      console.log('discover providerUri', providerUri);
       providerUri = OAUTH3_CORE.normalizeUrl(providerUri);
       var discObj = OAUTH3_CORE.urls.discover(providerUri, { appUrl: (opts.appUrl || getDefaultAppUrl()), debug: opts.debug });
 
@@ -74,7 +73,6 @@
         }
 
         window['--oauth3-callback-' + state] = function (params) {
-          console.info('[iframe] complete', params);
           resolve(params);
           cleanup();
         };
@@ -87,7 +85,7 @@
         }, opts.timeout || 15000);
 
         // TODO hidden / non-hidden (via directive even)
-        var framesrc = '<iframe src="' + url + '" ';
+        var framesrc = '<iframe class="js-oauth3-iframe" src="' + url + '" ';
         if (opts.debug) {
           framesrc += ' width="800px" height="800px" style="opacity: 0.8;" frameborder="1"';
         }
@@ -95,9 +93,8 @@
           framesrc += ' width="1px" height="1px" frameborder="0"';
         }
         framesrc += '></iframe>';
-        $iframe = $(framesrc);
 
-        $('body').append($iframe);
+        $('body').append(framesrc);
       });
 
       // TODO periodically garbage collect expired handlers from window object
@@ -119,7 +116,6 @@
         }
 
         window['--oauth3-callback-' + state] = function (params) {
-          //console.info('[popup] (or window) complete', params);
           resolve(params);
           cleanup();
         };
@@ -160,8 +156,6 @@
           , opts
           );
 
-          console.log('[DEBUG] [core] authorizationRedirect URL:', prequest);
-
           if (!prequest.state) {
             throw new Error("[Devolper Error] [authorization redirect] prequest.state is empty");
           }
@@ -178,8 +172,6 @@
           , opts
           );
 
-          console.log('[DEBUG] [core] implicitGrant URL', prequest);
-
           if (!prequest.state) {
             throw new Error("[Devolper Error] [implicit grant] prequest.state is empty");
           }
@@ -212,12 +204,6 @@
           , state: prequest.state
           };
 
-          //console.log('DEBUG oauth3.logout NIX insertIframe');
-          //console.log(url, params.redirect_uri);
-          //console.log(state);
-          //console.log(params); // redirect_uri
-          //console.log(opts);
-
           if (prequest.url === params.redirect_uri) {
             return OAUTH3.PromiseA.resolve();
           }
@@ -251,7 +237,7 @@
       // The client should have a list of allowed URLs to choose from and perhaps a wildcard will do
       //
       // api.example.com.evil.com SHOULD NOT match example.com
-      return dst.hostname !== src.hostname;
+      return dst.hostname === src.hostname;
     }
   , checkRedirect: function (client, query) {
       console.warn("[security] URL path checking not yet implemented");
@@ -343,12 +329,9 @@
       };
       preq.clientId = preq.appId = DaplieApiConfig.appId || DaplieApiConfig.clientId;
       preq.clientUri = preq.appUri = DaplieApiConfig.appUri || DaplieApiConfig.clientUri;
-      console.log('hackFormSubmit preq', preq);
       // TODO need a way to have middleware in Oauth3.request for TherapySession et al
-      return Oauth3.request(preq).then(function (resp) {
-        console.log('[DEBUG] grant code');
-        console.log(resp);
 
+      return Oauth3.request(preq).then(function (resp) {
         var err;
         var data = resp.data || {};
 
diff --git a/oauth3.js b/oauth3.js
index 035bcb1..3089181 100644
--- a/oauth3.js
+++ b/oauth3.js
@@ -75,7 +75,10 @@
 
       oauth3.hooks._stalePromise = oauth3.requests.refreshToken(
         staleSession.provider_uri
-      , staleSession
+      , { client_uri: staleSession.client_uri
+        , session: staleSession
+        , debug: staleSession.debug
+        }
       ).then(function (newSession) {
         oauth3.hooks._stalePromise = null;
         return newSession; // oauth3.hooks.refreshSession(staleSession, newSession);
@@ -87,7 +90,13 @@
     }
   , sessionExpired: function (expiredSession) {
       console.info('[oauth3.hooks.sessionExpired] called');
-      return oauth3.requests.refreshToken(expiredSession.provider_uri, expiredSession).then(function (newSession) {
+      return oauth3.requests.refreshToken(
+        expiredSession.provider_uri
+      , { client_uri: expiredSession.client_uri
+        , session: expiredSession
+        , debug: expiredSession.debug
+        }
+      ).then(function (newSession) {
         return newSession; // oauth3.hooks.refreshSession(expiredSession, newSession);
       });
     }