Don't mutate the authorization endpoint.

Flow should be reusable, Options object should not be
mutated by the calls performed on the flow.