remove invalid TODO

We are validating the params for both success and failure, in the
constructor. This step is checking for an actual authorization error
returned from the server.

Note: state will already have been verified by this point.