Gitter/gitter

@MadLittleMods I am messing with the grant flow, such that email access is never approved. This has never caused me problems before. All it does is give you null or non-presence of the field in all API responses containing the account email. It properly signs me in just fine, when I do this (after all, I wouldn't be talking here otherwise, right?). The problem I seem to have, is that I can't keep multiple sign-in sessions alive.
The code you linked to does not even make any attempt to use the email address, you shouldn't ask for it in the first place, if you don't need it (you never do, users should opt-in to any services which would use it, and be able to provide a different one).

Also, I may add: Don't use a web view in your application for the authorization flow, doing so defeats the OAuth flow trust training, that should have users learn not to enter their account credentials (username/email + password) in third-party applications. Send them to their web browser instead, and return them to a small web server running locally in your application to pass the authorization code with the refresh token grant. Though this tool being in all reasonable cases a notable exception, users typically do not know how to verify that an application isn't tampering with the login prompt, and rarely bother even, if they can, nor check for unnecessary permission grants and the like.