Missing `response_type` in POST authorization request returns 500 but should return 400 (`invalid_request`). Related gh-1874
