Fixed the authcode flow to work with one time passwords and external groups