Handle denied authorization properly

When the resource owner denies authorization (clicks "Cancel" on the authorize form), he is redirected to the frontpage of the oauth2 server.
According to the spec, he should be redirected back to the client (the client's redirect_url) with error=access_denied.