Token endpoint doesn't support AutoAuth

[fluffy-critter]

Current issues:

1. Needs to send root_uri, realm, and callback_uri on the code verification
2. In an AutoAuth verification response, it's just the status code that matters (no JSON response?) and so the values are filled in from the request, not the response

[fluffy-critter]

I am told that once again I have misunderstood something in the spec. What's supposed to happen is if callback_url is set, the Publ endpoint responds 202 with no body, and then makes the call to callback_url itself. Sheesh.

[fluffy-critter]

There's a better description of the actual steps taken by the token endpoint at https://www.svenknebel.de/temp/autoauth.html (via sknebel/AutoAuth#19). It looks like if the token endpoint gets a payload with callback_url then it needs to queue that stuff up. Which means, in Publ, that token stuff needs a worker threadpool, and the callback stuff should be parsed out. This also means that for callback_url everything can go in the background, unlike redirect_uri which has a synchronous response, so some refactoring is in order.

[fluffy-critter]

AutoAuth is dead, long live TicketAuth