Report empty /authorize requests as 400s

Looking at the rest of the code, it looks like ar is supposed to be the id of the ApplicationRequest, so I'd think catching an empty string would actually be a good thing, but I'm not particularly concerned about this.