Good post, breaks down the threat models really well. =)

One small note, I think there may be a small issue in one of the code blocks explaining the client key:

> cache_namespace = tenant_id || client_secret

I believe that should say `tenant_id + client_secret`, ya? To append them together? If you OR them out it'll default to the `tenant_id`, which isn't what you want in this case, I believe.