Authorization endpoint should protected by resource owner login, test with basic auth now (test break).