Fixed autologin flow

The request matcher was too restrictive. The autologin code generated
was not being verified on the authorize request.