All of the codes/tokens are only used in some phases of the authentication process -- `authorization_code` will be set to `NULL` at some point.