OAuth access_token endpoint returns 200 for invalid requests

[colemickens]

Select Topic Area

Bug

Body

Hi,

Just lost a bit of time to this today.

GitHub's OAuth access_tokens endpoint returns 200 for invalid requests.

This is quite annoying as SDKs tend to surface this in an unfortunate way - they think the request was valid, and then fail to deserialize the response.

It seems like a 4xx, maybe like 400, 401, 403 might be more appropriate than a 200 here.