token
This broke authorization for endpoints that only allow a code to be
used once (e.g. Known).
A side effect is that authorization no longer falls back to authentication
if the token endpoint does not exist or returns an error.
- Added a separate 'authenticate' flow to provide explicit support for
calling out to indieauth without requesting any sort of access
token.
- Redirect_url is now determined automatically based on the
authenticated_handler or authorized_handler annotations
Kyle Mahan