Record a finished authorization [write]

Call this when the browser arrives at success_url. The account is checked against the caller's own accounts at the app's provider, so an account somebody else authorized is refused; without account_id the caller's newest account for the app is used. Preserve the optional account_source returned in the callback to select the same provider when an account id is absent; every account remains bound to the authenticated caller and app. Every task of the caller that was waiting on the app continues. Answers 404 when the caller has no such account and 502 connect_error when the provider cannot be read.