add obtain-request-token to get-authorization-url

- dont provide obtain-request-token
- update comments, docs, and tests