This controller is called when a user should be authorized by an authorization server. As OAuth2 does not handle authorization directly, this controller ensures the request is valid, but requires the application to determine the value of $is_authorized