I'd like this to read: `default: %w(authorization_code implicit password_credentials client_credentials)`. That way they are strings and we avoid converting parameters to symbols (happens more than once in this PR). That allows memory leaks, and thus DoS.