user_id not required for authorization_code grant