I think this one is an obvious issue.

Caveat that the MSAL solution requires a tiny bit of non-free JavaScript, but YKPS students have to experience it at school anyways, so it's probably not a big deal. Perhaps password authentication could be supported as a fallback.