rewrite login, authorize, refresh to be route-less

[jeanetteclark]

rewrite these as decorator-less functions, which can then be used by a calling application (eg vegbank, ogdc-runner) when they make their own routing decisions.