uses 'code' for response_type on production. otherwise, uses 'token'.