POST should also be accepted for /authorize