oauth2server: authorization flow fixes

Fixes issues with the oauth2server authorization flow as well as adds test for restful APIS.

Supersedes PR #2003