Report empty /authorize requests as 400s

Is there a particular reason this isn't 
```
if not ar:
```

Should work fine either way, but if not is more consistent with the rest of the code.