Refactoring of authorization request handling

Now processes all the request parameters at once (in getAuthorizationRequest),
after an initial inspection to work out whether the error URL should use
a fragment or query response.

* Initial support for hybrid response_type support.
* Separate out code, token, id_token creation for reuse.
* Avoid repetition by accumulating a list of URL parameters and then
  rendering the final URL.