Skip authorize step if there's a verifier on the page
Use minimal access tokens for client/user pair