Allow authorization with a previously authenticated resource owner

This adds a new function `authorize_resource_owner/3` for establishing
authorization where the resource owner has already been authenticated.
Useful in the case where the Authentication Server is separate to the
Authorization Server.