Use GET not POST for authorize route