specifiy redirect behaviour for authorization endpoint lookup

[sknebel]

compare to https://indieauth.spec.indieweb.org/#discovery-by-clients

• permanent redirects shouldn't be allowed: you have to know who exactly you are logging in as
• temporary redirects have to be followed

[sknebel]

resolved in https://github.com/sknebel/AutoAuth/commit/d5040ee9a84cfba444dcb4f3cbbc067d7cf0f3c3