Authorized strategy for web apps.

This flow starts with an existing access token.