mod_http_oauth2: Check grant type before issuing refresh token This prevents even issuing a refresh token to a client that has not registered the corresponding grant type. The grant type dispatcher also checks before invoking the refresh token grant type handler.

This module blocks configured queries that change server state.

E.g. to make vCard storage read-only:

``` lua
readonly_stores = {
	vcard = { "vcard-temp", "vCard" };
}
```