Duplicate parameter checks & tests.
Unauthorized client tests.
Access denied test.
Response type tests.
Server error catching. Unavailability toggling.
Unsupported grant type tests.
Invalid grant tests.
Invalid client tests.
Invalid scope tests.
Extra credentials usage tests.
Invalidate auth code after use.
Two ways to validate scope on resource access.
Note on passing user in credentials.