This controller is called when a user should be authorized
by an authorization server. As OAuth2 does not handle
authorization directly, this controller ensures the request is valid, but
requires the application to determine the value of $is_authorized