The Good and the Bad of OAuth 2.0 Authorization Implementations