refactors handlers to make it more clear which code is run after a normal authorize OAuth flow, and the flow with the extra step of showing the signup form to the user
ensure that the groups handler is called on all authorize step (the first signup and subsequent logins)