mod_http_oauth2: Separate extracting credentials from requests and verifying The token endpoint also uses Basic auth, but the password would be the client_secret, so we need to verify against that instead of using test_password(). Splitting this up here avoids code duplication. Possibly this new function could go into util.http...

<tr>
  <th>What is {x} {op} {y}?</th><td>
    <input name="captcha_challenge" type="hidden" value="{challenge}">
    <input name="captcha_reply" pattern="[0-9]+" required type="number">
  </td></tr>