Changed
- Bugfix: authorization_handler was burning the auth code by
delegating to authentication_handler. This broke authorization for
endpoints that only allow codes to be used once. A side effect of
this is that authorization no longer falls back to authentication
when there is no token_endpoint or the token_endpoint request fails.