Authorization endpoint now supports code-based authn