Correct usage of authorization code