made jso_authrequest check for response_type in the config; defaults to token