OAuth2 handshake: properly match redirect_uri