Currently the ignore fields in the AuthorizePOST handler has the following values hard coded:

        // XXX csrf shouldn't be hard coded here
        skip := []string{"accept", "client_id", "redirect_uri", "state", "csrf"}

This shouldn't be the case obviously. I think we just add an optional function to the config struct passed into the service constructor. If present, we use that. If not, we use the hard coded list as those fields are default in the main form.