Support legacy token request via authorization endpoint

legacy implementation used POST /oauth/authorize for both the user facing authorization screen and the API endpoint to request a token ... so, we have to support it here.
explain or nuke