get /authorize redirects with code
get /authorize redirects to redirect_uri
post /tokens should return 401 with bad creds