Why its required? I think this method is useless because have only check for code param in request. Or we should extend it to check error and csrf