Remove tokeninfo check because oauth_flow.step2_exchange(code) will only succeed if code is valid for the current app.