title: Why should /oauth/authorize be secured?
body: <p>According to <a href="http://projects.spring.io/spring-security-oauth/docs/oauth2.html" rel="noreferrer">http://projects.spring.io/spring-security-oauth/docs/oauth2.html</a>:</p>
  
  <blockquote>
    <p>N.B. the Authorization endpoint /oauth/authorize (or its mapped
    alternative) should be protected using Spring Security so that it is
    only accessible to authenticated users.</p>
  </blockquote>
  
  <p>Why is that? It doesn't sound right that an endpoint that will require an authorization grant to exchange for an authorization code should be secured. It's like a login page for a login page, specially when Authorization grant will be through resource owner password credentials.</p>