auth:  Authorization API is for resource servers

Add separate handling for resource servers and clients, so that we can
clearly differentiate them.