Approve or deny OAuth consent

Requires current browser session, exact session-bound pending request, CSRF cookie/form equality and same Origin. Decision is single-use and expires after five minutes. Approval rechecks registered client, scopes, user/account/membership and current authority under locks. Authorization code expires after 60 seconds; never issued by a GET. Denial redirects access_denied only to the validated redirect. At most five active grants per client/user and twenty per user.

Additional request headers:

• Origin (required): Must match the browser request origin for CSRF validation.