support for form_post response mode for OAuth2

[richvdh]

https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html defines a form_post response mode for returning Authorization Response parameters from the Authorization Endpoint. This mode is required by Apple when requesting non-default scopes (https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms), which we believe is required to enable FaceID/TouchID.

I think that supporting form_post is pretty trivial; we should do so.