To me, these read more as background / prerequisite sections, rather than things that are specific to the authorization server setup. Not sure if these should thus maybe move to be part of section 2?