refactors the authorization code flow

[remcojansen]

Restructures the authorization code flow and isolates the following parts more clearly:

• execution of the flow itself
• requests / responses to the authorization endpoint
• running the http server for the callback endpoint