oauth: split the authorize endpoint by request verb

page() fell out of the bottom of its POST branch into the consent page, so
neither verb's path could be read on its own. Dispatch on the verb once and
give each path a method of its own, the consent page becoming the GET body.

Verbs beyond GET, HEAD and POST now get the 405 the token and registration
endpoints already return rather than the consent form, and _open_login_frame()
is _open_center_frame().

JIRA-Ref: CMK-38012
Change-Id: I29a7844133ba6ef88d9967fa92a1a1958013c815