Stale authorize session used for authenticated users

Thinking about it some more the next day,

• maybe 'automatic authorization' isn't necessarily needed for this to reproduce. Didn't test it yet, but if it's not enabled, the code in the else statement calling validateAuthorizeRequest() would fail and then immediately return a response, where it it should probably be able to actually connect.
• My proposal for the fix could probably be easier as there's already the same 3 lines of code in the anonymous check. Maybe everything could

    if ($bridgeRequest->get('client_id')) {
      $_SESSION['oauth2_server_authorize'] = $bridgeRequest;
    }

    if ($this->currentUser()->isAnonymous()) {
            $url = new Url('user.login', [], ['query' => ['destination' => Url::fromRoute('oauth2_server.authorize')->toString()]]);
      $url->setAbsolute(TRUE);
      return new RedirectResponse($url->toString());
    }

This means though that $_SESSION will always contain the 'oauth2_server_authorize' which might not be necessary at all. But that would also be the case in my original proposal, so maybe that one could be changed a bit like this:

  if ($this->currentUser()->isAnonymous()) {
    // This part stays the same
  }
  else {
    // A user may be authenticated at this point (e.g. registration flow ..)
    if ($bridgeRequest->get('client_id') && isset($_SESSION['oauth2_server_authorize'])) {
      $_SESSION['oauth2_server_authorize'] = $bridgeRequest;
    }
  }

Feedback welcome of course :)

Changing title as it makes more sense I think