$authorization.fetch_access_token! will only succeed if code is valid for the current app.