get /authorize returns 400 with bad redirect_uri
post /tokens returns 401 with wrong redirect_uri
post /tokens returns 401 with repeat code
remove unused validator code
remove outdated comment
don't needlessly re-query client objects
use client argument instead of request.client
remove unused request.client_{id,secret}
Merge pull request #7 from mark-burnett/expand-validator

Expand request validator