For the actual Authorization Request there are currently three main options:

1. passing as URL with encoded parameters
2. passing a request object as value
3. passing a request object per reference (request_uri)

To my knowledge, the majority of implementations are currently favoring option 3. However, the specification does not offer examples for option 2 and three, which would be useful for new people.

Additionally, listing the three options in the start of Section 5 might be helpful.