Support legacy token request via authorization endpoint

legacy implementation used POST /oauth/authorize for both the user facing
authorization screen and the API endpoint to request a token ... so, we
have to support it here.