Webserver flow

Before merge:
- [x]  tests for redirect after authorization
- [x] Behaviour when error should be passed using a redirection but the redirect_uri is invalid (see https://github.com/ebu/cpa-spec/pull/59/files#diff-7cb6b57aad01efd64ce8e773e20d137cR1293)
- [x] Scope and domain
- [ ] Verify usage of `state`