Hardening oauth endpoints

Approve endpoint restricted to POST-only with CSRF token hardening in OAuth confirmation flow.