rephrase authorization server confirmation section

[sknebel]

this sounds a bit as if you need to implement both paths, I'd prefer it to be clearer that the first case is an optimization (since depending on tooling used, recording each individual step can be surprisingly tricky)

[aaronpk]

I think I'm going to add a step to the flow diagram with an arrow from client to user URL, even though that fetch might be skipped in some cases