Like in verify_redirection_uri, we pass the Identity to make it possible to include the registered scope.