README update: redirect_uri not required in code/token exchange