title: What's the difference between unauthorized_client and access_denied
body: <p>I'm reading the <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.2.2.1" rel="nofollow noreferrer">oauth2 specs</a> and I'm confused by <code>unauthorized_client</code> and <code>access_denied</code> error codes. They seem to express the same error condition, isn't it? At first glance(by error code) I thought one is for authentication failure and the other for authorisation failure but they are really both about authorisation failure which would translate into a http 403 status code.</p>
  <pre><code> unauthorized_client
         The client is not authorized to request an access token
         using this method.
  
   access_denied
         The resource owner or authorization server denied the
         request.
  </code></pre>