Fix incorrect authorization response success URL.

The client redirect_uri was no longer being prepended to the redirect,
resulting in a relative redirect to the authorization server instead.
Updated tests to check for this.
Support max_age request parameter

If the user authenticated more than max_age seconds previously, they
will be reauthenticated before continuing.
Tidying up

- HLint suggestions
- Generalize failW function