Fixes to authorization object

* Member names can be anything, it is member values which are constrained.
* In oauth2, it is loginEndpoint, not loginEndPoint.