Also isn't the check for `redirect_uri` redundant, given that it's also checked as part of `valid_for_authorization?`