cleans up redirect URI validation
Return from verifyResourceRequest() if we don't have token data

This ensures any error response already set in getAccessTokenData gets
returned, not overwritten by the 'insufficient_scope' error.