Don't verify redirect url if response_type is token.