strip leading slash (if present) from authorization code