Make validateAuthorizeRequest not specific to a single HTTP method.

This pull request changes `AuthorizeController::validateAuthorizeRequest` to retrieve parameters from either the GET or POST params. (Currently it expects them as GET params.)

A `GET` form will send usernames and passwords in the URL, which could be cached in the user's browser history. This makes `POST` more secure. The spec doesn't enforce one method over the other.