Add grant approval, scope.Add, ClientAuthorization update, unit tests

I would take this off AuthConfig and just have it be `getCSRF` to indicate it's not contextual to the authconfig today.