When entering a domain on the app page, I get this error: Non-local OAuth 2 redirect URIs may not start with "http:" or "javascript:"
http://mydomain.test/login/check-dropbox
Now I understand you don't want to open all domains etc, but the .test domain is a clear usecase for local development since June 1999: https://tools.ietf.org/html/rfc2606#page-2
Can you allow, if the tld is .test that I can add it as a redirect without https?