Report empty /authorize requests as 400s

Yeah, that probably wouldn't hurt. Mainly here I wanted not to throw an exception when people visit the URL for no reason. It might be worthwhile to think about the UX here and maybe add an explanatory message