Allow authorization with a previously authenticated resource owner

This adds a new function `authorize_resource_owner/3` where the
resource owner has already been established.  Useful in the case where
the Authentication Server is separate to the Authorization Server.