Upgrade to latest UAA that has the following fixes
1. An access_confirmation_error page to handle the forward:/oauth/error like the JSP pages did
2. Has a backwards compatible scope parsing filter so that /oauth/authorize is parsing comma delimited scopes properly
3. Properly handle the error when a client is not present for authorization