Just spotted this, too. Looks interesting. Wonder if it would be easier to use this for Cloudron logins where people wanted to use other oAuth providers?
This has been fixed now with https://git.cloudron.io/cloudron/box/commit/2bde023d4dc783761553a0a7be88650e5885b4ad and should be part of the next release.