Added comment
Renamed 'access_denied' to 'cancelled' to align with spec
Added test case with incorrect domain parameter to POST /authorized
Refactored test code