diff --git a/dist/index.cjs b/dist/index.cjs
index 635f1c0134274c89e7efbcae2adf3d9ecba575ee..3f4dfb779a55deaae2c188a442b78ca519d5c17d 100644
--- a/dist/index.cjs
+++ b/dist/index.cjs
@@ -517,7 +517,7 @@ function applyPublicAuth(clientId, params) {
 }
 /** Loopback hosts exempt from the in-transit `https:` requirement (RFC 8252 §7.3). */
 function isLoopbackHost(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
 }
 /**
 * SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint.
@@ -977,7 +977,6 @@ async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, o
 	else {
 		const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
 		url = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
-		url.search = issuer.search;
 	}
 	let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
 	if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) response = await tryMetadataDiscovery(new URL(`/.well-known/${wellKnownType}`, issuer), protocolVersion, fetchFn);
@@ -1158,7 +1157,6 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
 	authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl));
 	if (state) authorizationUrl.searchParams.set("state", state);
 	if (scope) authorizationUrl.searchParams.set("scope", scope);
-	if (scope?.split(" ").includes("offline_access")) authorizationUrl.searchParams.append("prompt", "consent");
 	if (resource) authorizationUrl.searchParams.set("resource", resource.href);
 	return {
 		authorizationUrl,
diff --git a/dist/index.mjs b/dist/index.mjs
index f02ce3ca394e826fc27c9848dbe9a214bf6ba7a9..3508b8e841bb8d3d724fa5ff573902dbca81cf89 100644
--- a/dist/index.mjs
+++ b/dist/index.mjs
@@ -514,7 +514,7 @@ function applyPublicAuth(clientId, params) {
 }
 /** Loopback hosts exempt from the in-transit `https:` requirement (RFC 8252 §7.3). */
 function isLoopbackHost(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
 }
 /**
 * SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint.
@@ -974,7 +974,6 @@ async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, o
 	else {
 		const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
 		url = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
-		url.search = issuer.search;
 	}
 	let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
 	if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) response = await tryMetadataDiscovery(new URL(`/.well-known/${wellKnownType}`, issuer), protocolVersion, fetchFn);
@@ -1155,7 +1154,6 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
 	authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl));
 	if (state) authorizationUrl.searchParams.set("state", state);
 	if (scope) authorizationUrl.searchParams.set("scope", scope);
-	if (scope?.split(" ").includes("offline_access")) authorizationUrl.searchParams.append("prompt", "consent");
 	if (resource) authorizationUrl.searchParams.set("resource", resource.href);
 	return {
 		authorizationUrl,