Remove hardcoded values in ExpressAuthorizeRequest (Fixes #121)