When the authorization request is faulty in some way return a error response. Code flow or implicit depending on response_type. If the error has something to do with the return_uri return the response to the user not the RP.