fixed some bugs, but still not able to change code correctly. Besides, swapping code is not a possible vul, need to change this to sr.
previous redirect call didn't work. It's available in Gecko 20 called 'redirectTo', but we just modify location header for now. the original access_token works.