Use response_type=token to combine auth code request and token request