Remove Aeson upper bound

Current release is 0.8 and we should require >= 0.7.0.6 since it fixes
DoS vulnerabilities.
Add missing "code token" response_type
Fix authorization response redirect

Since this is already a full redirect URL (to the client), it shouldn’t
be prepending the issuer URL.
Refactoring of authorization request handling

Now processes all the request parameters at once (in getAuthorizatioRequest),
after an initial inspection to work out whether the error URL should use
a fragment or query response.

* Initial support for hybrid response_type support.
* Separate out code, token, id_token creation for reuse.
* Avoid repetition by accumulating a list of URL parameters and then
  rendering the final URL.