check for available strategies before processing on endpoints
completely turn off disabled strategies on token endpoint (see note)

Note: I'm not sure whether this is necessary, as there is already a
validation in Doorkeeper::Request.