fallback onto authorization_endpoint