It seems both important and straightforward to extend /.well-known/smart-configuration to advertise web messaging capabilities. Given the awkwardness of our broad scopes, it would be useful if the app authenticated to the capabilities endpoint so the server could dynamically tell the app exactly which parameters it could access.