Remove tokeninfo check. $client->authenticate($code) will only succeed if code is valid for the current app.