`GET /oauth/authorize` takes no credential, so the reference it printed went back to whoever followed the request_uri. An approving client reads it from `bot.did.getAuthorization` instead. The account is now rendered as text, and the refusal branches the page could never reach are gone. Change-Id: I3bdb25d0fac565f8869f7666d9dec5c021a2a982