Report empty /authorize requests as 400s

I wanted to handle the particular case of a missing argument. If it's passed as a query arg with an empty string I dunno what happens