Interestingly, I left a simulator running for a long while and came back to my desk and hit the "authenticate" button.
The Safari view caused by using ASWebAuthenticationSession came up, was blank/invalid, and I got a callback from the authentication provider..
The header that caused this was:
Location: myapp://auth#state=17A26C7A-AFDE-4C3B-BA89-85FAA343F0DB&error=invalid_request_object&error_description=Expired%20jwt
I'm partially happy it worked at least once, but am also confused it doesn't work when it should