mod_oauth: No ACL check on authorize URL; just check if logged in