barnabyhave a function which accepts an HTTP request object and returns an HTTP response. if the request is an auth code redeeming request, pass it off to the auth token redeeming logic. otherwise, pass it off to the authorization flow logic, wrapped in a CSRF middleware
