Apply suggestions from code review

Co-authored-by: Simon Li <[email protected]>

docs/source/conf.py

@@ -231,5 +231,4 @@ def setup(app):
     # 2023-06-29 docs refresh
     "topic/cilogon": "tutorials/provider-specific-setup/providers/cilogon",
     "tutorials/provider-specific-setup/providers/awscognito": "tutorials/provider-specific-setup/providers/generic",
-    "how-to/migrations/upgrade-to-16": "reference/changelog",
 }

docs/source/reference/changelog.md

@@ -33,14 +33,14 @@ command line for details.
   and `shown_idps`, `username_claim`, `additional_username_claims` must no
   longer be configured.
 - [Okpy] The public functions `OkpyOAuthenticator.get_auth_request` and
-  `OkpyOAuthenticator.get_user_info_request` was removed.
+  `OkpyOAuthenticator.get_user_info_request` were removed.
 
 ### Deprecations
 
-- [Generic, Auth0] `username_key` is deprecated and is being replaced by
+- [Generic, Auth0] `username_key` is deprecated and is replaced by
   {attr}`.OAuthenticator.username_claim`.
 - [Generic] {attr}`.GenericOAuthenticator.extra_params` is deprecated and is
-  being replaced by {attr}`.OAuthenticator.token_params`.
+  replaced by {attr}`.OAuthenticator.token_params`.
 
 ### Highlights
 
@@ -50,7 +50,7 @@ command line for details.
 - [All] {attr}`.OAuthenticator.refresh_pre_spawn` is now by default enabled if
   {attr}`.OAuthenticator.enable_auth_state` is enabled.
 
-- [All] Low level configurations in `GenericOAuthenticator` has been moved to
+- [All] Low level configuration in `GenericOAuthenticator` has been moved to
   the common base class `OAuthenticator` and is therefore available to all
   authenticators.
 

oauthenticator/oauth2.py

@@ -303,8 +303,8 @@ class OAuthenticator(Authenticator):
         config=True,
         help="""
         The URL to where the user is to be redirected initially based on the
-        OAuth2 protocol. The user is supposed to be redirected back with a
-        `authorization grant code`_ after interacting successfully with the
+        OAuth2 protocol. The user will be redirected back with an
+        `authorization grant code`_ after authenticating successfully with the
         identity provider.
 
         .. _authorization grant code: https://www.rfc-editor.org/rfc/rfc6749#section-1.3.1
@@ -527,7 +527,7 @@ def _validate_server_cert_default(self):
 
             # Example: validate against certain root certificates
             c.OAuthenticator.http_request_kwargs = {
-                "ca_certs": "/run/secrets/kubernetes.io/serviceaccount/ca.crt",
+                "ca_certs": "/path/to/a.crt",
             }
 
         See :external:py:class:`tornado.httpclient.HTTPRequest` for all kwargs