Passing the fragment would also enable using the Itch game page as the OAuth callback URL, allowing to circumvent the lack of Itch API object in browsers runtime. (This would require the player to click on a scary "Login using Itch" button and allowing permissions, but it's better than the current nothing that forces us to host outside of Itch...)