Fix response_type checking in authorization controller