/authorize is accessed via get instead of post