Correct handling of not_approved=true in the /authorize callback.