OAuth /authorize call returning HTTP 500 for invalid input

[rflprr]

Currently, for example, if client_id or redirect_uri are invalid, app returns HTTP 500.
Instead, app should return HTTP 400.